tree f0b08ccf42c410d088ab576c0d3936fb8488ce47
parent 4e65fc127d8cd073ff76101640c146c15925172b
author Ken Chen <cken@google.com> 1548501420 +0800
committer JP Sugarbroad <jpsugar@google.com> 1550007446 -0800

Clear Element.mRef immediately after deallocating it

DNSServiceRefDeallocate() and pointer dereferencing in request handler
thread are protected by two separate lock/unlock pairs on mHeadMutex.
If rescan() runs between these, it could dereference mRef, causing
a heap-use-after-free bug.

Solution: set mRef to null immediately after freeing it.

Bug: 121327565
Test: build
Change-Id: I56ace2ad8a2da528afa375aefb1b9420547658a7
(cherry picked from commit 9762bc1964a37ec56091ee2b6070e19c5206f615)