From 5c09c4c3c7794fd49d64dc3429d157f1a4bb5a72 Mon Sep 17 00:00:00 2001
From: John Brooks <john.brooks@theqtcompany.com>
Date: Fri, 6 Nov 2015 14:15:57 -0800
Subject: Fix use-after-free in AVFCameraService during renderer destruction

Change-Id: I10a994b71e55565c0de31aa0c34f32964e2e3a1b
Reviewed-by: Jake Petroules <jake.petroules@theqtcompany.com>
---
 src/plugins/avfoundation/camera/avfcameraservice.mm | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

(limited to 'src/plugins')

diff --git a/src/plugins/avfoundation/camera/avfcameraservice.mm b/src/plugins/avfoundation/camera/avfcameraservice.mm
index fd473b37b..20156f06f 100644
--- a/src/plugins/avfoundation/camera/avfcameraservice.mm
+++ b/src/plugins/avfoundation/camera/avfcameraservice.mm
@@ -203,18 +203,15 @@ QMediaControl *AVFCameraService::requestControl(const char *name)
 
 void AVFCameraService::releaseControl(QMediaControl *control)
 {
-    if (m_videoOutput == control) {
-        m_session->setVideoOutput(0);
-        delete m_videoOutput;
-        m_videoOutput = 0;
-    }
     AVFMediaVideoProbeControl *videoProbe = qobject_cast<AVFMediaVideoProbeControl *>(control);
     if (videoProbe) {
         m_session->removeProbe(videoProbe);
         delete videoProbe;
-        return;
+    } else if (m_videoOutput == control) {
+        m_session->setVideoOutput(0);
+        delete m_videoOutput;
+        m_videoOutput = 0;
     }
-
 }
 
 AVFMediaRecorderControl *AVFCameraService::recorderControl() const
-- 
cgit v1.2.3