diff options
| author |  Craig Tiller <ctiller@google.com> | 2016-04-26 21:07:53 -0700 |
|---|---|---|
| committer | Craig Tiller <ctiller@google.com> | 2016-04-26 21:07:53 -0700 |
| commit | 9859d8d2969ab28541a91b77a321d9c7265c45fd (patch) | |
| tree | 2f30282fe2b25e4fb7231968f2e1b768d5ef9180 /src/core | |
| parent | 144ab982d8bcfa42ee56345c6f684efb9ac7f997 (diff) | |
Fix use-after-free
Diffstat (limited to 'src/core')
| -rw-r--r-- | src/core/lib/surface/call.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/core/lib/surface/call.c b/src/core/lib/surface/call.c index f33688beef..3f31e77247 100644 --- a/src/core/lib/surface/call.c +++ b/src/core/lib/surface/call.c @@ -373,7 +373,6 @@ static void destroy_call(grpc_exec_ctx *exec_ctx, void *call, bool success) { if (c->receiving_stream != NULL) { grpc_byte_stream_destroy(exec_ctx, c->receiving_stream); } - GRPC_CHANNEL_INTERNAL_UNREF(exec_ctx, c->channel, "call"); gpr_mu_destroy(&c->mu); for (i = 0; i < STATUS_SOURCE_COUNT; i++) { if (c->status[i].details) { @@ -391,7 +390,9 @@ static void destroy_call(grpc_exec_ctx *exec_ctx, void *call, bool success) { if (c->cq) { GRPC_CQ_INTERNAL_UNREF(c->cq, "bind"); } + grpc_channel *channel = c->channel; grpc_call_stack_destroy(exec_ctx, CALL_STACK_FROM_CALL(c), c); + GRPC_CHANNEL_INTERNAL_UNREF(exec_ctx, channel, "call"); GPR_TIMER_END("destroy_call", 0); } |