pidgin: 1a8574b1: Re-arrange msn_slplink_destroy and msn_s...

[qulogic at pidgin.im]

-----------------------------------------------------------------
Revision: 1a8574b1e440cce02e4e9ba89bf94ed58e31d17b
Ancestor: 313a8935368ac818f1098323a148beae93f98bb8
Author: qulogic at pidgin.im
Date: 2008-08-08T04:47:50
Branch: im.pidgin.pidgin
URL: http://d.pidgin.im/viewmtn/revision/info/1a8574b1e440cce02e4e9ba89bf94ed58e31d17b

Modified files:
        libpurple/protocols/msn/slpcall.c
        libpurple/protocols/msn/slplink.c

ChangeLog: 

Re-arrange msn_slplink_destroy and msn_slp_call_destroy. Might help 
avoid use-after-free in slp.c got_emoticon and got_user_display.

-------------- next part --------------
============================================================
--- libpurple/protocols/msn/slpcall.c	7e75e4d97135dd1491b92eab20779a223b6f7f77
+++ libpurple/protocols/msn/slpcall.c	67d9d0231b6422a28d8791bd31bd1af2c1bc41e7
@@ -70,10 +70,6 @@ msn_slp_call_destroy(MsnSlpCall *slpcall
 	if (slpcall->timer)
 		purple_timeout_remove(slpcall->timer);
 
-	g_free(slpcall->id);
-	g_free(slpcall->branch);
-	g_free(slpcall->data_info);
-
 	for (e = slpcall->slplink->slp_msgs; e != NULL; )
 	{
 		MsnSlpMessage *slpmsg = e->data;
@@ -100,6 +96,10 @@ msn_slp_call_destroy(MsnSlpCall *slpcall
 	if (slpcall->xfer != NULL)
 		purple_xfer_unref(slpcall->xfer);
 
+	g_free(slpcall->id);
+	g_free(slpcall->branch);
+	g_free(slpcall->data_info);
+
 	g_free(slpcall);
 }
 
============================================================
--- libpurple/protocols/msn/slplink.c	5d58b24c3c2fc25028c74a4eca2338dc3b979daa
+++ libpurple/protocols/msn/slplink.c	9e60a48cff5d4d9c79d6d331cd0c8fd4000ab21c
@@ -101,9 +101,6 @@ msn_slplink_destroy(MsnSlpLink *slplink)
 
 	session = slplink->session;
 
-	g_free(slplink->local_user);
-	g_free(slplink->remote_user);
-
 #if 0
 	if (slplink->directconn != NULL)
 		msn_directconn_destroy(slplink->directconn);
@@ -117,6 +114,9 @@ msn_slplink_destroy(MsnSlpLink *slplink)
 	session->slplinks =
 		g_list_remove(session->slplinks, slplink);
 
+	g_free(slplink->local_user);
+	g_free(slplink->remote_user);
+
 	g_free(slplink);
 }