Fix: lttng_trace_archive_location_serialize is called on freed memory

[lttng-tools.git] / src / lib / lttng-ctl / destruction-handle.c

diff --git a/src/lib/lttng-ctl/destruction-handle.c b/src/lib/lttng-ctl/destruction-handle.c
index aeeece7e316abad31884c5498667b1fb09f60f3c..6d8a26b113481914ff01e8e691d23eec23699750 100644 (file)
--- a/src/lib/lttng-ctl/destruction-handle.c
+++ b/src/lib/lttng-ctl/destruction-handle.c
@@ -59,7 +59,7 @@ void lttng_destruction_handle_destroy(struct lttng_destruction_handle *handle)
        }
        lttng_poll_clean(&handle->communication.events);
        lttng_dynamic_buffer_reset(&handle->communication.buffer);
-       lttng_trace_archive_location_destroy(handle->location);
+       lttng_trace_archive_location_put(handle->location);
        free(handle);
 }
 
@@ -173,6 +173,7 @@ int handle_state_transition(struct lttng_destruction_handle *handle)
                        ret = -1;
                        break;
                } else {
+                       /* Ownership is transferred to the destruction handle. */
                        handle->location = location;
                        handle->communication.state = COMMUNICATION_STATE_END;
                }
@@ -227,7 +228,6 @@ enum lttng_destruction_handle_status
 lttng_destruction_handle_wait_for_completion(
                struct lttng_destruction_handle *handle, int timeout_ms)
 {
-       int ret;
        enum lttng_destruction_handle_status status;
        unsigned long time_left_ms = 0;
        const bool has_timeout = timeout_ms > 0;
@@ -246,7 +246,7 @@ lttng_destruction_handle_wait_for_completion(
                goto end;
        }
        if (has_timeout) {
-               ret = lttng_clock_gettime(CLOCK_MONOTONIC, &initial_time);
+               int ret = lttng_clock_gettime(CLOCK_MONOTONIC, &initial_time);
                if (ret) {
                        status = LTTNG_DESTRUCTION_HANDLE_STATUS_ERROR;
                        goto end;