Fix use-after-free error.

rconn_destroy() decrements the n_queued counters that are set up by
rconn_send(), so we need to destroy the rconn before we destroy anything
that used it.

(This system is more error-prone than I imagined.)

diff --git a/controller/controller.c b/controller/controller.c
index dcffee44e3b7adf459e9bf793607a69f6b61501f..ff3f8cf3a89ba82e62f195706ffcb305e7c05bf3 100644 (file)
--- a/controller/controller.c
+++ b/controller/controller.c
@@ -174,8 +174,8 @@ main(int argc, char *argv[])
                     }
                     i++;
                 } else {
-                    lswitch_destroy(this->lswitch);
                     rconn_destroy(this->rconn);
+                    lswitch_destroy(this->lswitch);
                     switches[i] = switches[--n_switches];
                 }
             }