Fix use-after-free when the input is still in use by someone else (refs #1287).

Unfortunately, this does not really solve the problem as vlc_object_destroy can still return without actually deleting the object in case of a deadlock.
One could argue the deadlock is the problem rather than vlc_object_destroy implementation.

diff --git a/src/input/input.c b/src/input/input.c
index 017effed4ca3cacfc248d4a30b7fc4cf67c3fff7..cb93cb7818adce9bab6933e1ed1c7053cd658e39 100644 (file)
--- a/src/input/input.c
+++ b/src/input/input.c
@@ -272,23 +272,23 @@ static input_thread_t *Create( vlc_object_t *p_parent, input_item_t *p_item,
 static void Destroy( input_thread_t *p_input, sout_instance_t **pp_sout )
 {
     vlc_object_detach( p_input );
+    input_thread_private_t *priv = p_input->p;
 
     if( pp_sout )
         *pp_sout = NULL;
-    if( p_input->p->p_sout )
+    if( priv->p_sout )
     {
         if( pp_sout )
-            *pp_sout = p_input->p->p_sout;
-        else if( p_input->p->b_sout_keep )
-            SoutKeep( p_input->p->p_sout );
+            *pp_sout = priv->p_sout;
+        else if( priv->b_sout_keep )
+            SoutKeep( priv->p_sout );
         else
-            sout_DeleteInstance( p_input->p->p_sout );
+            sout_DeleteInstance( priv->p_sout );
     }
 
-    vlc_mutex_destroy( &p_input->p->lock_control );
-    free( p_input->p );
-
     vlc_object_destroy( p_input );
+    vlc_mutex_destroy( &priv->lock_control );
+    free( priv );
 }
 
 /**