From 855772ae5a3821e5579363bdaad960e38a63028c Mon Sep 17 00:00:00 2001 From: Chocobo1 Date: Mon, 11 Sep 2017 13:11:09 +0800 Subject: [PATCH] Fix dereferencing freed pointer. Closes #7420. The torrent is removed from session after `deleteTorrent()` yet we still invoke `torrent->name()`, thus result in crash. --- src/base/bittorrent/session.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/base/bittorrent/session.cpp b/src/base/bittorrent/session.cpp index 8803194a7..8759e3501 100644 --- a/src/base/bittorrent/session.cpp +++ b/src/base/bittorrent/session.cpp @@ -1724,8 +1724,8 @@ void Session::processShareLimits() if ((ratio <= TorrentHandle::MAX_RATIO) && (ratio >= ratioLimit)) { Logger* const logger = Logger::instance(); if (m_maxRatioAction == Remove) { - deleteTorrent(torrent->hash()); logger->addMessage(tr("'%1' reached the maximum ratio you set. Removed.").arg(torrent->name())); + deleteTorrent(torrent->hash()); } else if (!torrent->isPaused()) { torrent->pause(); @@ -1748,8 +1748,8 @@ void Session::processShareLimits() if ((seedingTimeInMinutes <= TorrentHandle::MAX_SEEDING_TIME) && (seedingTimeInMinutes >= seedingTimeLimit)) { Logger* const logger = Logger::instance(); if (m_maxRatioAction == Remove) { - deleteTorrent(torrent->hash()); logger->addMessage(tr("'%1' reached the maximum seeding time you set. Removed.").arg(torrent->name())); + deleteTorrent(torrent->hash()); } else if (!torrent->isPaused()) { torrent->pause();