epg: fix the reference to the freed EPG event, fixes #4107

diff --git a/src/epg.c b/src/epg.c
index 51046f0ed38113eddc360b10b71937e86b43487e..4275bcbfcb0a54bc2e3a849c4980678c590bec13 100644 (file)
--- a/src/epg.c
+++ b/src/epg.c
@@ -165,14 +165,18 @@ static void _epg_object_getref ( void *o )
   eo->refcount++;
 }
 
-static void _epg_object_putref ( void *o )
+static int _epg_object_putref ( void *o )
 {
   epg_object_t *eo = o;
   tvhtrace(LS_EPG, "eo [%p, %u, %d, %s] putref %d",
            eo, eo->id, eo->type, eo->uri, eo->refcount-1);
   assert(eo->refcount>0);
   eo->refcount--;
-  if (!eo->refcount) eo->destroy(eo);
+  if (!eo->refcount) {
+    eo->destroy(eo);
+    return 1;
+  }
+  return 0;
 }
 
 static void _epg_object_set_updated ( void *o )
@@ -1750,8 +1754,10 @@ static epg_broadcast_t *_epg_channel_add_broadcast
     timer = 1;
   }
 
-  /* Reset timer */
+  /* Reset timer - it might free return event! */
+  ret->getref(ret);
   if (timer) _epg_channel_timer_callback(ch);
+  if (ret->putref(ret)) return NULL;
   return ret;
 }
 

diff --git a/src/epg.h b/src/epg.h
index 6ecf16eae3df273a17c9101e9094d362291756e9..f7f4601ecbfede01a58e621e6f722be169945fbb 100644 (file)
--- a/src/epg.h
+++ b/src/epg.h
@@ -149,7 +149,7 @@ struct epg_object
   struct epggrab_module  *grabber;    ///< Originating grabber
 
   void (*getref)  ( void *o );        ///< Get a reference
-  void (*putref)  ( void *o );               ///< Release a reference
+  int  (*putref)  ( void *o );               ///< Release a reference
   void (*destroy) ( void *o );        ///< Delete the object
   void (*update)  ( void *o );        ///< Updated
 };