flimflam: fix use-after-free of hidden network

src/network.c

 /*
  *
  *  Connection Manager
  *
  *  Copyright (C) 2007-2009  Intel Corporation. All rights reserved.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  *
@@ skipping 876 matching lines @@
  * Mark network disconnected and update associated service and
  * device to reflect network state change.
  */
 int connman_network_set_disconnected(struct connman_network *network)
 {
         int err;
 
         _DBG_NETWORK("network %p state %s", network,
             state_names[network->state]);
 
+        /* NB: hold a ref as the network may be reclaimed */
+        (void) connman_network_ref(network);
+
         err = connman_network_set_disconnected_only(network);
-        if (err != 0)
-                return err;
+        if (err == 0 && network->registered == TRUE)
+                set_connected(network);
 
-        if (network->registered == FALSE) {
-                /* NB: should not happen */
-                _DBG_NETWORK("not registered; defer");
-                g_idle_add(set_connected, network);
-        } else {
-                set_connected(network);
-        }
-        return 0;
+        connman_network_unref(network);
+
+        return err;
 }
 
 /**
  * __connman_network_disconnect:
  * @network: network structure
  *
  * Disconnect network.
  */
 int __connman_network_disconnect(struct connman_network *network)
 {
@@ skipping 702 matching lines @@
 }
 
 void __connman_network_cleanup(void)
 {
         _DBG_NETWORK("");
 
         connman_driver_unregister(&network_driver);
 
         dbus_connection_unref(connection);
 }