diff options
| author | mannol <eniz_vukovic@hotmail.com> | 2016-12-20 22:31:47 +0100 |
|---|---|---|
| committer | mannol <eniz_vukovic@hotmail.com> | 2016-12-21 00:16:22 +0100 |
| commit | 7122d2e862e028a730478d88cd61557fbed16ebf (patch) | |
| tree | 6cf6f89b09ef8040fa33280c73d81022b16a316a /toxcore/onion.h | |
| parent | de623f9eb99acdc8522ae18c3abe9eea760371a4 (diff) | |
Use after free reported in #278 occurs because toxav_kill()
calls msi_kill() (toxav.c:180) which frees msi_call instances (msi.c:161)
which are then used when call_remove() (toxav.c:1136) is called.
This fix prevents call_remove() from calling invalid pointer.
Fixes #278
Diffstat (limited to 'toxcore/onion.h')
0 files changed, 0 insertions, 0 deletions