From a74343f19917350ce2d8c80049fe2afb1f2f4809 Mon Sep 17 00:00:00 2001 From: Bart Polot Date: Thu, 5 Dec 2013 02:13:36 +0000 Subject: [PATCH] - avoid dereferencing copy after channel (and therefore copy) was destroyed --- src/mesh/gnunet-service-mesh_channel.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/mesh/gnunet-service-mesh_channel.c b/src/mesh/gnunet-service-mesh_channel.c index 07bb4007b..420e207b3 100644 --- a/src/mesh/gnunet-service-mesh_channel.c +++ b/src/mesh/gnunet-service-mesh_channel.c @@ -922,7 +922,7 @@ channel_rel_free_all (struct MeshChannelReliability *rel) { GNUNET_SCHEDULER_cancel (rel->retry_task); } - if (NULL != rel->uniq) + if (NULL != rel->uniq && NULL != rel->uniq->q) GMT_cancel (rel->uniq->q); GNUNET_free (rel); } @@ -1041,19 +1041,21 @@ rel_message_free (struct MeshReliableMessage *copy, int update_time) LOG (GNUNET_ERROR_TYPE_DEBUG, "!!! batch free, ignoring timing\n"); } rel->ch->pending_messages--; - if (GNUNET_NO != rel->ch->destroy && 0 == rel->ch->pending_messages) - { - struct MeshTunnel3 *t = rel->ch->t; - GMCH_destroy (rel->ch); - GMT_destroy_if_empty (t); - } if (NULL != copy->q) { GMT_cancel (copy->q->q); + /* copy->q is set to NULL by ch_message_sent */ } GNUNET_CONTAINER_DLL_remove (rel->head_sent, rel->tail_sent, copy); LOG (GNUNET_ERROR_TYPE_DEBUG, " COPYFREE %p\n", copy); GNUNET_free (copy); + + if (GNUNET_NO != rel->ch->destroy && 0 == rel->ch->pending_messages) + { + struct MeshTunnel3 *t = rel->ch->t; + GMCH_destroy (rel->ch); + GMT_destroy_if_empty (t); + } } -- 2.25.1