-quick and dirty use-after-free fix in LM

1 files changed, 29 insertions, 0 deletions

diff --git a/src/lockmanager/gnunet-service-lockmanager.c b/src/lockmanager/gnunet-service-lockmanager.c
index 91e103aa0..56a9b6bc6 100644
--- a/src/lockmanager/gnunet-service-lockmanager.c
+++ b/src/lockmanager/gnunet-service-lockmanager.c
@@ -718,6 +718,32 @@ handle_release (void *cls, struct GNUNET_SERVER_Client *client,
 }
 
 
+static int
+stop_lock_attempt (void *cls,
+                   const struct GNUNET_HashCode *key,
+                   void *value)
+{
+  struct ClientList *cl_entry = cls;
+  struct Lock *lock = value;
+  struct WaitList *wl;
+  struct WaitList *next;
+
+  next = lock->wl_head;
+  while (NULL != (wl = next))
+  {
+    next = wl->next;
+    if (wl->cl_entry == cl_entry)
+    {
+      GNUNET_CONTAINER_DLL_remove (lock->wl_head,
+                                   lock->wl_tail,
+                                   wl);
+      GNUNET_free (wl);
+    }
+  }
+  return GNUNET_OK;
+}
+
+
 /**
  * Callback for client disconnect
  *
@@ -744,6 +770,9 @@ client_disconnect_cb (void *cls, struct GNUNET_SERVER_Client *client)
     cl_ll_remove_lock (cl_entry, ll_entry);
     process_lock_release (lock);
   }
+  GNUNET_CONTAINER_multihashmap_iterate (lock_map,
+                                         &stop_lock_attempt,
+                                         cl_entry);
   cl_remove_client (cl_entry);
 }