From d87f838e0985c3d30f4a4160f133be5bb46cfb13 Mon Sep 17 00:00:00 2001
From: Pauli Virtanen <pav@iki.fi>
Date: Sat, 9 Jan 2021 20:36:38 +0200
Subject: [PATCH] media-session: don't write to freed memory in
 sm_object_destroy

Unref of node->handle may also free obj, if it was created by
init_object.
---
 src/examples/media-session/media-session.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/examples/media-session/media-session.c b/src/examples/media-session/media-session.c
index f553f23a3..b82116922 100644
--- a/src/examples/media-session/media-session.c
+++ b/src/examples/media-session/media-session.c
@@ -317,13 +317,13 @@ int sm_object_destroy(struct sm_object *obj)
 		spa_list_remove(&d->link);
 		free(d);
 	}
-	if (p)
-		pw_proxy_unref(p);
-	if (h)
-		pw_proxy_unref(h);
 
 	obj->proxy = NULL;
 	obj->handle = NULL;
+	if (p)
+		pw_proxy_unref(p);
+	if (h)
+		pw_proxy_unref(h);  /* may free obj, if from init_object */
 
 	return 0;
 }