disarm timer on release

This is a repeat timer, if not stopped, it will run again triggering UAF.

1 files changed, 1 insertions, 2 deletions

diff --git a/src/core.c b/src/core.c
index 0da582c..952e1b0 100644
--- a/src/core.c
+++ b/src/core.c
@@ -40,6 +40,7 @@ static void tip_client_release(struct ev_loop *loop, struct tip_client *cli)
 	       inet_ntoa(cli->addr.sin_addr), htons(cli->addr.sin_port));
 
 	list_del(&cli->list);
+	ev_timer_stop(loop, &cli->timer);
 	ev_io_stop(loop, &cli->io);
 	shutdown(cli->io.fd, SHUT_RDWR);
 	close(cli->io.fd);
@@ -196,7 +197,6 @@ shutdown:
 	if (cli->size > FILE_SIZE_THRESHOLD)
 		tip_client_redirect_create(cli);
 close:
-	ev_timer_stop(loop, &cli->timer);
 	tip_client_release(loop, cli);
 }
 
@@ -300,7 +300,6 @@ static void tip_client_write_cb(struct ev_loop *loop, struct ev_io *io, int even
 	}
 	return;
 close:
-	ev_timer_stop(loop, &cli->timer);
 	tip_client_release(loop, cli);
 }