pulse-server: free pending sample reply

If the sample finished playing before we finished the roundtrip to
get the sink_index, it will be destroyed. When the roundtrip completes,
it will try to use invalid memoryy and crash.

Make sure we destroy all pending replies before destroying the sample
to avoid this problem.

Fixes #2151

src/modules/module-protocol-pulse/operation.c

@@ -66,6 +66,16 @@ void operation_free(struct operation *o)
 	free(o);
 }
 
+struct operation *operation_find(struct client *client, uint32_t tag)
+{
+	struct operation *o;
+	spa_list_for_each(o, &client->operations, link) {
+		if (o->tag == tag)
+			return o;
+	}
+	return NULL;
+}
+
 void operation_complete(struct operation *o)
 {
 	struct client *client = o->client;

src/modules/module-protocol-pulse/operation.h

@@ -43,6 +43,7 @@ int operation_new(struct client *client, uint32_t tag);
 int operation_new_cb(struct client *client, uint32_t tag,
 		void (*callback) (void *data, struct client *client, uint32_t tag),
 		void *data);
+struct operation *operation_find(struct client *client, uint32_t tag);
 void operation_free(struct operation *o);
 void operation_complete(struct operation *o);
 

src/modules/module-protocol-pulse/pending-sample.c

@@ -29,6 +29,7 @@
 #include "client.h"
 #include "internal.h"
 #include "log.h"
+#include "operation.h"
 #include "pending-sample.h"
 #include "sample-play.h"
 
@@ -36,10 +37,14 @@ void pending_sample_free(struct pending_sample *ps)
 {
 	struct client * const client = ps->client;
 	struct impl * const impl = client->impl;
+	struct operation *o;
 
 	spa_list_remove(&ps->link);
 	spa_hook_remove(&ps->listener);
 	pw_work_queue_cancel(impl->work_queue, ps, SPA_ID_INVALID);
 
+	if ((o = operation_find(client, ps->tag)) != NULL)
+		operation_free(o);
+
 	sample_play_destroy(ps->play);
 }

src/modules/module-protocol-pulse/pulse-server.c

@@ -2353,6 +2353,10 @@ static void on_sample_done(void *obj, void *data, int res, uint32_t id)
 {
 	struct pending_sample *ps = obj;
 	struct client *client = ps->client;
+	struct operation *o;
+
+	if ((o = operation_find(client, ps->tag)) != NULL)
+		operation_complete(o);
 
 	pending_sample_free(ps);
 	client_unref(client);