commit 2edfa6237b379e8d8e842e70c878e123c8106397
author Ken Chen <cken@google.com> Sat Jan 26 19:17:00 2019 +0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 12 13:37:26 2019 -0800
tree f0b08ccf42c410d088ab576c0d3936fb8488ce47
parent 4e65fc127d8cd073ff76101640c146c15925172b

Clear Element.mRef immediately after deallocating it

DNSServiceRefDeallocate() and pointer dereferencing in request handler
thread are protected by two separate lock/unlock pairs on mHeadMutex.
If rescan() runs between these, it could dereference mRef, causing
a heap-use-after-free bug.

Solution: set mRef to null immediately after freeing it.

Bug: 121327565
Test: build
Change-Id: I56ace2ad8a2da528afa375aefb1b9420547658a7
(cherry picked from commit 9762bc1964a37ec56091ee2b6070e19c5206f615)