[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[GNUnet-SVN] r37718 - gnunet/src/set
From: |
gnunet |
Subject: |
[GNUnet-SVN] r37718 - gnunet/src/set |
Date: |
Sun, 14 Aug 2016 13:55:16 +0200 |
Author: grothoff
Date: 2016-08-14 13:55:16 +0200 (Sun, 14 Aug 2016)
New Revision: 37718
Modified:
gnunet/src/set/set_api.c
Log:
fix use-after-free issue
Modified: gnunet/src/set/set_api.c
===================================================================
--- gnunet/src/set/set_api.c 2016-08-14 11:55:02 UTC (rev 37717)
+++ gnunet/src/set/set_api.c 2016-08-14 11:55:16 UTC (rev 37718)
@@ -382,6 +382,7 @@
struct GNUNET_SET_OperationHandle *oh;
struct GNUNET_SET_Element e;
enum GNUNET_SET_Status result_status;
+ int destroy_set;
GNUNET_assert (NULL != set->mq);
result_status = ntohs (msg->result_status);
@@ -422,6 +423,11 @@
GNUNET_CONTAINER_DLL_remove (set->ops_head,
set->ops_tail,
oh);
+ /* Need to do this calculation _before_ the result callback,
+ as IF the application still has a valid set handle, it
+ may trigger destruction of the set during the callback. */
+ destroy_set = (GNUNET_YES == set->destroy_requested) &&
+ (NULL == set->ops_head);
if (NULL != oh->result_cb)
{
oh->result_cb (oh->result_cls,
@@ -433,8 +439,7 @@
LOG (GNUNET_ERROR_TYPE_DEBUG,
"No callback for final status\n");
}
- if ( (GNUNET_YES == set->destroy_requested) &&
- (NULL == set->ops_head) )
+ if (destroy_set)
GNUNET_SET_destroy (set);
GNUNET_free (oh);
return;
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [GNUnet-SVN] r37718 - gnunet/src/set,
gnunet <=