- fix use after free

diff --git a/src/mesh/Makefile.am b/src/mesh/Makefile.am
index 82f59b1c878815f86719bdbd8ea84185b18a6387..7b61426260303da64666a27a94291d7b1e0e85fb 100644 (file)
--- a/src/mesh/Makefile.am
+++ b/src/mesh/Makefile.am
@@ -107,7 +107,8 @@ check_PROGRAMS = \
   test_mesh_small_speed_nobuf  \
   test_mesh_small_speed_backwards  \
   test_mesh_small_speed_nobuf_backwards \
-  test_mesh_small_speed_reliable
+  test_mesh_small_speed_reliable \
+  test_mesh_small_speed_reliable_backwards
 endif
 
 ld_mesh_test_lib = \
@@ -171,6 +172,11 @@ test_mesh_small_speed_reliable_SOURCES = \
 test_mesh_small_speed_reliable_LDADD = $(ld_mesh_test_lib)
 test_mesh_small_speed_reliable_DEPENDENCIES = $(dep_mesh_test_lib)
 
+test_mesh_small_speed_reliable_backwards_SOURCES = \
+  test_mesh_small.c
+test_mesh_small_speed_reliable_backwards_LDADD = $(ld_mesh_test_lib)
+test_mesh_small_speed_reliable_backwards_DEPENDENCIES = $(dep_mesh_test_lib)
+
 
 if ENABLE_TEST_RUN
 TESTS = \

diff --git a/src/mesh/gnunet-service-mesh.c b/src/mesh/gnunet-service-mesh.c
index 3a248ab79248ea4a5277a9263e43b8bf6239b0cb..a7801a573ce977e305fb9a164d01032d5894bfa3 100644 (file)
--- a/src/mesh/gnunet-service-mesh.c
+++ b/src/mesh/gnunet-service-mesh.c
@@ -2334,8 +2334,7 @@ tunnel_retransmit_message (void *cls,
 
   t = rel->t;
   copy = rel->head_sent;
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!! Retransmit \n");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!!  id %u\n", copy->id);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!! RETRANSMIT %u\n", copy->id);
 
   payload = (struct GNUNET_MESH_Data *) &copy[1];
   hop = rel == t->fwd_rel ? t->next_hop : t->prev_hop;
@@ -3978,8 +3977,7 @@ handle_mesh_data_ack (void *cls, const struct GNUNET_PeerIdentity *peer,
     return GNUNET_OK;
   }
 
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!! ACK \n");
-  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!!  ack  %u\n", ack);
+  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!! ACK %u\n", ack);
   for (work = GNUNET_NO, copy = rel->head_sent; copy != NULL; copy = next)
   {
     struct GNUNET_TIME_Relative time;
@@ -3991,17 +3989,18 @@ handle_mesh_data_ack (void *cls, const struct GNUNET_PeerIdentity *peer,
     }
     work = GNUNET_YES;
     GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!!  id %u\n", copy->id);
-    GNUNET_CONTAINER_DLL_remove (rel->head_sent, rel->tail_sent, copy);
     next = copy->next;
-    GNUNET_free (copy);
     time = GNUNET_TIME_absolute_get_duration (copy->timestamp);
     rel->expected_delay.rel_value += time.rel_value;
     rel->expected_delay.rel_value /= 2;
-    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!!  new expected delay %s!\n",
+    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!!  new expected delay %s\n",
                 GNUNET_STRINGS_relative_time_to_string (rel->expected_delay,
                                                         GNUNET_NO));
     rel->retry_timer = rel->expected_delay;
+    GNUNET_CONTAINER_DLL_remove (rel->head_sent, rel->tail_sent, copy);
+    GNUNET_free (copy);
   }
+
   if (GNUNET_YES == work)
   {
     if (GNUNET_SCHEDULER_NO_TASK != rel->retry_task)
@@ -4760,6 +4759,7 @@ handle_local_data (void *cls, struct GNUNET_SERVER_Client *client,
                             + sizeof(struct GNUNET_MESH_Data)
                             + size);
       copy->id = fc->last_pid_recv + 1;
+      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "!!! DATA %u\n", copy->id);
       copy->timestamp = GNUNET_TIME_absolute_get ();
       rel = (tid < GNUNET_MESH_LOCAL_TUNNEL_ID_SERV) ? t->fwd_rel : t->bck_rel;
       copy->rel = rel;