sipsess/reply: fix heap-use-after-free bug (#1179)

* sipsess/reply: fix heap-use-after-free bug fixes #1178 - `mem_deref(sess)` calls maybe list_flush(&sess->replyl) within destructor and reply is a dangling pointer after this. * deref reply before session
baresip · Aug 19, 2024 · 5b00488 · 5b00488
1 parent ee1be80
commit 5b00488
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/sipsess/reply.c b/src/sipsess/reply.c
@@ -66,7 +66,9 @@ static void tmr_handler(void *arg)
 		}
 	}
 	else {
+		mem_deref(reply);
 		mem_deref(sess);
+		return;
 	}
 
 	mem_deref(reply);