[Spice-devel] [PATCH spice-server 07/10] red_channel: call reds_stream_free only after all the channel_client fields have been reset

[Yonit Halperin]

---
 server/red_channel.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/server/red_channel.c b/server/red_channel.c
index 9d71543..7fde50d 100644
--- a/server/red_channel.c
+++ b/server/red_channel.c
@@ -1680,6 +1680,7 @@ static void red_channel_client_disconnect_dummy(RedChannelClient *rcc)
 
 void red_channel_client_disconnect(RedChannelClient *rcc)
 {
+    RedsStream *stream;
     spice_printerr("%p (channel %p type %d id %d)", rcc, rcc->channel,
                                                 rcc->channel->type, rcc->channel->id);
     if (rcc->dummy) {
@@ -1694,14 +1695,19 @@ void red_channel_client_disconnect(RedChannelClient *rcc)
         rcc->channel->core->watch_remove(rcc->stream->watch);
         rcc->stream->watch = NULL;
     }
-    reds_stream_free(rcc->stream);
-    rcc->stream = NULL;
     if (rcc->latency_monitor.timer) {
         rcc->channel->core->timer_remove(rcc->latency_monitor.timer);
         rcc->latency_monitor.timer = NULL;
     }
     red_channel_remove_client(rcc);
     rcc->channel->channel_cbs.on_disconnect(rcc);
+    stream = rcc->stream;
+    rcc->stream = NULL;
+    /* reds_stream_free can lead to the whole client disconnection
+     * (see reds_handle_channel_event).
+     * We set stream = NULL before closing the stream, to avoid
+     * double release, if red_channel_client_disconnect is called again */
+    reds_stream_free(stream);
 }
 
 void red_channel_disconnect(RedChannel *channel)
-- 
1.8.1.4