From: Felix Fietkau <nbd@nbd.name>
Date: Tue, 23 Aug 2016 10:55:08 +0000 (+0200)
Subject: ubusd: fix sending remove-object notification
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=686c05d738a7a1f7ec62c47807f07f6f642904b1;p=project%2Fubus.git

ubusd: fix sending remove-object notification

Patch by Delio Brignoli <brignoli.delio@gmail.com>

Both ubusd_free_object (eventually via ubusd_create_object_event_msg)
and ubus_proto_send_msg_from_blob() use the same message buffer.
So ubusd_handle_remove_object builds the payload which gets (indirectly)
overwritten by the call to ubusd_free_object and then sent again by
ubus_proto_send_msg_from_blob.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/ubusd_proto.c b/ubusd_proto.c
index 0624574..53e507a 100644
--- a/ubusd_proto.c
+++ b/ubusd_proto.c
@@ -130,8 +130,8 @@ static int ubusd_handle_remove_object(struct ubus_client *cl, struct ubus_msg_bu
 	if (obj->type && obj->type->refcount == 1)
 		blob_put_int32(&b, UBUS_ATTR_OBJTYPE, obj->type->id.id);
 
-	ubusd_free_object(obj);
 	ubus_proto_send_msg_from_blob(cl, ub, UBUS_MSG_DATA);
+	ubusd_free_object(obj);
 
 	return 0;
 }