flimflam: fix use-after-free of hidden network

src/network.c

Index: src/network.c
diff --git a/src/network.c b/src/network.c
index b234cc1a0ed84a89f318785db9cd44474f8ba035..7a00ff01ba087dd6a69270ec719571e11cb41933 100644
--- a/src/network.c
+++ b/src/network.c
@@ -894,18 +894,16 @@ int connman_network_set_disconnected(struct connman_network *network)
 	_DBG_NETWORK("network %p state %s", network,
 	    state_names[network->state]);
 
-	err = connman_network_set_disconnected_only(network);
-	if (err != 0)
-		return err;
+	/* NB: hold a ref as the network may be reclaimed */
+	(void) connman_network_ref(network);
 
-	if (network->registered == FALSE) {
-		/* NB: should not happen */
-		_DBG_NETWORK("not registered; defer");
-		g_idle_add(set_connected, network);
-	} else {
+	err = connman_network_set_disconnected_only(network);
+	if (err == 0 && network->registered == TRUE)
 		set_connected(network);
-	}
-	return 0;
+
+	connman_network_unref(network);
+
+	return err;
 }
 
 /**