Fix use-after-free on buddy removal

diff --git a/chime-contact.c b/chime-contact.c
index 10dc667a1469fb53c65bdd6597a6bf5da62e9878..bf4848eeb44d11f91ef61f3d224990f9bcf21a8e 100644 (file)
--- a/chime-contact.c
+++ b/chime-contact.c
@@ -765,13 +765,14 @@ void chime_connection_remove_contact_async(ChimeConnection *cxn,
        }
 
        GTask *task = g_task_new(cxn, cancellable, callback, user_data);
-       /* Assume success; we'll refetch and reinstate it on failure */
-       chime_object_collection_hash_object(&priv->contacts, CHIME_OBJECT(contact), FALSE);
 
        SoupURI *uri = soup_uri_new_printf(priv->contacts_url, "/contacts/%s",
                                           chime_object_get_id(CHIME_OBJECT(contact)));
        chime_connection_queue_http_request(cxn, NULL, uri, "DELETE",
                                            contact_removed_cb, task);
+
+       /* Assume success; we'll refetch and reinstate it on failure */
+       chime_object_collection_hash_object(&priv->contacts, CHIME_OBJECT(contact), FALSE);
 }
 
 gboolean chime_connection_remove_contact_finish(ChimeConnection *self,

diff --git a/chime-object.c b/chime-object.c
index eafc10115d0ef4854eabd36eaeafc3a03ea6519e..f64fbe202836a8227b370f89fadfdb9de5cd1d83 100644 (file)
--- a/chime-object.c
+++ b/chime-object.c
@@ -239,6 +239,12 @@ void chime_object_collection_hash_object(ChimeObjectCollection *collection, Chim
 
        priv->generation = collection->generation;
 
+       if (!priv->collection) {
+               priv->collection = collection;
+               g_hash_table_insert(collection->by_id, priv->id, object);
+               g_hash_table_insert(collection->by_name, priv->name, object);
+       }
+
        if (live && priv->is_dead) {
                g_object_ref(object);
                priv->is_dead = FALSE;
@@ -248,12 +254,6 @@ void chime_object_collection_hash_object(ChimeObjectCollection *collection, Chim
                g_object_notify(G_OBJECT(object), "dead");
                g_object_unref(object);
        }
-
-       if (!priv->collection) {
-               priv->collection = collection;
-               g_hash_table_insert(collection->by_id, priv->id, object);
-               g_hash_table_insert(collection->by_name, priv->name, object);
-       }
 }
 
 void chime_object_collection_expire_outdated(ChimeObjectCollection *coll)