Fixed crash when connection was killed during the packet callback.

2 files changed, 18 insertions, 1 deletions

diff --git a/toxcore/friend_connection.c b/toxcore/friend_connection.c
index aaffe02f..894ba61a 100644
--- a/toxcore/friend_connection.c
+++ b/toxcore/friend_connection.c
@@ -274,6 +274,11 @@ static int handle_packet(void *object, int number, uint8_t *data, uint16_t lengt
         if (friend_con->callbacks[i].data_callback)
             friend_con->callbacks[i].data_callback(friend_con->callbacks[i].data_callback_object,
                                                    friend_con->callbacks[i].data_callback_id, data, length);
+
+        friend_con = get_conn(fr_c, number);
+
+        if (!friend_con)
+            return -1;
     }
 
     return 0;
@@ -296,6 +301,11 @@ static int handle_lossy_packet(void *object, int number, const uint8_t *data, ui
         if (friend_con->callbacks[i].lossy_data_callback)
             friend_con->callbacks[i].lossy_data_callback(friend_con->callbacks[i].lossy_data_callback_object,
                     friend_con->callbacks[i].lossy_data_callback_id, data, length);
+
+        friend_con = get_conn(fr_c, number);
+
+        if (!friend_con)
+            return -1;
     }
 
     return 0;
diff --git a/toxcore/net_crypto.c b/toxcore/net_crypto.c
index bcb1dc6d..be2f967d 100644
--- a/toxcore/net_crypto.c
+++ b/toxcore/net_crypto.c
@@ -1180,6 +1180,12 @@ static int handle_data_packet_helper(const Net_Crypto *c, int crypt_connection_i
             if (conn->connection_data_callback)
                 conn->connection_data_callback(conn->connection_data_callback_object, conn->connection_data_callback_id, dt.data,
                                                dt.length);
+
+            /* conn might get killed in callback. */
+            conn = get_crypto_connection(c, crypt_connection_id);
+
+            if (conn == 0)
+                return -1;
         }
 
         /* Packet counter. */
@@ -1187,11 +1193,12 @@ static int handle_data_packet_helper(const Net_Crypto *c, int crypt_connection_i
     } else if (real_data[0] >= PACKET_ID_LOSSY_RANGE_START &&
                real_data[0] < (PACKET_ID_LOSSY_RANGE_START + PACKET_ID_LOSSY_RANGE_SIZE)) {
 
+        set_buffer_end(&conn->recv_array, num);
+
         if (conn->connection_lossy_data_callback)
             conn->connection_lossy_data_callback(conn->connection_lossy_data_callback_object,
                                                  conn->connection_lossy_data_callback_id, real_data, real_length);
 
-        set_buffer_end(&conn->recv_array, num);
     } else {
         return -1;
     }