Fix use-after-free error in EV_CLOSURE_EVENT callback

diff --git a/event.c b/event.c
index a5e8d0b1e9914f24802bad14be191eb42b5a8fc6..f319497753119223d6a9e9c919a64badb36c86a0 100644 (file)
--- a/event.c
+++ b/event.c
@@ -1569,8 +1569,9 @@ event_process_active_single_queue(struct event_base *base,
                        event_persist_closure(base, ev);
                        break;
                case EV_CLOSURE_EVENT: {
-                       void (*evcb_callback)(evutil_socket_t, short, void *) = *ev->ev_callback;
+                       void (*evcb_callback)(evutil_socket_t, short, void *);
                        EVUTIL_ASSERT(ev != NULL);
+                       evcb_callback = *ev->ev_callback;
                        EVBASE_RELEASE_LOCK(base, th_base_lock);
                        evcb_callback(ev->ev_fd, ev->ev_res, ev->ev_arg);
                }