gnunet-svn
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[GNUnet-SVN] r37718 - gnunet/src/set


From: gnunet
Subject: [GNUnet-SVN] r37718 - gnunet/src/set
Date: Sun, 14 Aug 2016 13:55:16 +0200

Author: grothoff
Date: 2016-08-14 13:55:16 +0200 (Sun, 14 Aug 2016)
New Revision: 37718

Modified:
   gnunet/src/set/set_api.c
Log:
fix use-after-free issue

Modified: gnunet/src/set/set_api.c
===================================================================
--- gnunet/src/set/set_api.c    2016-08-14 11:55:02 UTC (rev 37717)
+++ gnunet/src/set/set_api.c    2016-08-14 11:55:16 UTC (rev 37718)
@@ -382,6 +382,7 @@
   struct GNUNET_SET_OperationHandle *oh;
   struct GNUNET_SET_Element e;
   enum GNUNET_SET_Status result_status;
+  int destroy_set;
 
   GNUNET_assert (NULL != set->mq);
   result_status = ntohs (msg->result_status);
@@ -422,6 +423,11 @@
   GNUNET_CONTAINER_DLL_remove (set->ops_head,
                                set->ops_tail,
                                oh);
+  /* Need to do this calculation _before_ the result callback,
+     as IF the application still has a valid set handle, it
+     may trigger destruction of the set during the callback. */
+  destroy_set = (GNUNET_YES == set->destroy_requested) &&
+                (NULL == set->ops_head);
   if (NULL != oh->result_cb)
   {
     oh->result_cb (oh->result_cls,
@@ -433,8 +439,7 @@
     LOG (GNUNET_ERROR_TYPE_DEBUG,
          "No callback for final status\n");
   }
-  if ( (GNUNET_YES == set->destroy_requested) &&
-       (NULL == set->ops_head) )
+  if (destroy_set)
     GNUNET_SET_destroy (set);
   GNUNET_free (oh);
   return;




reply via email to

[Prev in Thread] Current Thread [Next in Thread]