- Fix potential use after free

- Fix segfault if there is no preparse and/or fetcher object

diff --git a/src/playlist/thread.c b/src/playlist/thread.c
index 360cd66e062bd2c65d0b590f88f059af03bec374..30ae2858e5fddf499dba2423e4dd916892b5d7ce 100644 (file)
--- a/src/playlist/thread.c
+++ b/src/playlist/thread.c
@@ -143,22 +143,22 @@ int playlist_ThreadDestroy( playlist_t * p_playlist )
     // Kill preparser
     if( p_playlist->p_preparse )
     {
-        vlc_cond_signal( &p_playlist->p_preparse->object_wait );
+        vlc_object_kill( p_playlist->p_preparse );
+        vlc_thread_join( p_playlist->p_preparse );
         free( p_playlist->p_preparse->pp_waiting );
+        vlc_object_detach( p_playlist->p_preparse );
+        vlc_object_destroy( p_playlist->p_preparse );
     }
-    vlc_thread_join( p_playlist->p_preparse );
-    vlc_object_detach( p_playlist->p_preparse );
-    vlc_object_destroy( p_playlist->p_preparse );
 
     // Kill meta fetcher
     if( p_playlist->p_fetcher )
     {
-        vlc_cond_signal( &p_playlist->p_fetcher->object_wait );
+        vlc_object_kill( p_playlist->p_fetcher );
+        vlc_thread_join( p_playlist->p_fetcher );
         free( p_playlist->p_fetcher->p_waiting );
+        vlc_object_detach( p_playlist->p_fetcher );
+        vlc_object_destroy( p_playlist->p_fetcher );
     }
-    vlc_thread_join( p_playlist->p_fetcher );
-    vlc_object_detach( p_playlist->p_fetcher );
-    vlc_object_destroy( p_playlist->p_fetcher );
 
     // Wait for thread to complete
     vlc_thread_join( p_playlist );