Use after free reported in #278 occurs because toxav_kill()

calls msi_kill() (toxav.c:180) which frees msi_call instances (msi.c:161)
which are then used when call_remove() (toxav.c:1136) is called.
This fix prevents call_remove() from calling invalid pointer.

Fixes #278

1 files changed, 1 insertions, 0 deletions

diff --git a/toxav/toxav.c b/toxav/toxav.c
index 49058b8f..59c0c1e4 100644
--- a/toxav/toxav.c
+++ b/toxav/toxav.c
@@ -188,6 +188,7 @@ void toxav_kill(ToxAV *av)
 
         while (it) {
             call_kill_transmission(it);
+            it->msi_call = NULL; /* msi_kill() frees the call's msi_call handle; which causes #278 */
             it = call_remove(it); /* This will eventually free av->calls */
         }
     }