From: Jaroslav Kysela <perex@perex.cz>
Date: Tue, 6 Dec 2016 10:28:16 +0000 (+0100)
Subject: epg: fix the reference to the freed EPG event, fixes #4107
X-Git-Tag: v4.2.1~186
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b3f72d7e4cfd10cc9ad863004ee39a6e9da45b42;p=thirdparty%2Ftvheadend.git

epg: fix the reference to the freed EPG event, fixes #4107
---

diff --git a/src/epg.c b/src/epg.c
index 51046f0ed..4275bcbfc 100644
--- a/src/epg.c
+++ b/src/epg.c
@@ -165,14 +165,18 @@ static void _epg_object_getref ( void *o )
   eo->refcount++;
 }
 
-static void _epg_object_putref ( void *o )
+static int _epg_object_putref ( void *o )
 {
   epg_object_t *eo = o;
   tvhtrace(LS_EPG, "eo [%p, %u, %d, %s] putref %d",
            eo, eo->id, eo->type, eo->uri, eo->refcount-1);
   assert(eo->refcount>0);
   eo->refcount--;
-  if (!eo->refcount) eo->destroy(eo);
+  if (!eo->refcount) {
+    eo->destroy(eo);
+    return 1;
+  }
+  return 0;
 }
 
 static void _epg_object_set_updated ( void *o )
@@ -1750,8 +1754,10 @@ static epg_broadcast_t *_epg_channel_add_broadcast
     timer = 1;
   }
 
-  /* Reset timer */
+  /* Reset timer - it might free return event! */
+  ret->getref(ret);
   if (timer) _epg_channel_timer_callback(ch);
+  if (ret->putref(ret)) return NULL;
   return ret;
 }
 
diff --git a/src/epg.h b/src/epg.h
index 6ecf16eae..f7f4601ec 100644
--- a/src/epg.h
+++ b/src/epg.h
@@ -149,7 +149,7 @@ struct epg_object
   struct epggrab_module  *grabber;    ///< Originating grabber
 
   void (*getref)  ( void *o );        ///< Get a reference
-  void (*putref)  ( void *o ); 	      ///< Release a reference
+  int  (*putref)  ( void *o ); 	      ///< Release a reference
   void (*destroy) ( void *o );        ///< Delete the object
   void (*update)  ( void *o );        ///< Updated
 };