From b8cb8957e4e4f91a62acc831ae37cced3656a389 Mon Sep 17 00:00:00 2001
From: Armstrong <Armstrong@sweelia.com>
Date: Fri, 13 Oct 2023 15:26:31 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DWebApi=E9=80=80=E5=87=BA?=
 =?UTF-8?q?=E6=B8=85=E7=90=86=E6=97=B6=E9=87=8D=E5=A4=8D=E6=9E=90=E6=9E=84?=
 =?UTF-8?q?=E9=97=AE=E9=A2=98=20(#2900)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. s_???Map.clear()会触发key/value的析构，先执行析构再移除map成员。析构执行完之前map成员仍然有可见性。
2. s_???Map的成员析构时，根据当前状态，可能触发回调，如播放终止回调。
3. 在状态变更的回调函数中，通过s_???Map.erase(key)的方式解注册，此时也会触发一次析构。

两次析构导致double free：a) map.erase, b) map.clear

Signed-off-by: ArmstrongCN <armstrong@sweelia.com>
---
 server/WebApi.cpp | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/server/WebApi.cpp b/server/WebApi.cpp
index e8081756..7c8e35c0 100755
--- a/server/WebApi.cpp
+++ b/server/WebApi.cpp
@@ -1911,24 +1911,28 @@ void installWebApi() {
 void unInstallWebApi(){
     {
         lock_guard<recursive_mutex> lck(s_proxyMapMtx);
-        s_proxyMap.clear();
+        auto proxyMap(std::move(s_proxyMap));
+        proxyMap.clear();
     }
 
     {
         lock_guard<recursive_mutex> lck(s_ffmpegMapMtx);
-        s_ffmpegMap.clear();
+        auto ffmpegMap(std::move(s_ffmpegMap));
+        ffmpegMap.clear();
     }
 
     {
         lock_guard<recursive_mutex> lck(s_proxyPusherMapMtx);
-        s_proxyPusherMap.clear();
+        auto proxyPusherMap(std::move(s_proxyPusherMap));
+        proxyPusherMap.clear();
     }
 
     {
 #if defined(ENABLE_RTPPROXY)
         RtpSelector::Instance().clear();
         lock_guard<recursive_mutex> lck(s_rtpServerMapMtx);
-        s_rtpServerMap.clear();
+        auto rtpServerMap(std::move(s_rtpServerMap));
+        rtpServerMap.clear();
 #endif
     }
     NoticeCenter::Instance().delListener(&web_api_tag);