diff options
author | Christian Grothoff <christian@grothoff.org> | 2016-08-14 11:55:16 +0000 |
---|---|---|
committer | Christian Grothoff <christian@grothoff.org> | 2016-08-14 11:55:16 +0000 |
commit | 44f731908bf2c9551b913292f29fed12c425846f (patch) | |
tree | bcecf39b978eb83319074235433d5baeb623db81 /src/set | |
parent | d87f02395bb84c9f57b085170c8c14e4c33985ba (diff) | |
download | gnunet-44f731908bf2c9551b913292f29fed12c425846f.tar.gz gnunet-44f731908bf2c9551b913292f29fed12c425846f.zip |
fix use-after-free issue
Diffstat (limited to 'src/set')
-rw-r--r-- | src/set/set_api.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/src/set/set_api.c b/src/set/set_api.c index b8daf3212..3e9a4fdcf 100644 --- a/src/set/set_api.c +++ b/src/set/set_api.c | |||
@@ -382,6 +382,7 @@ handle_result (void *cls, | |||
382 | struct GNUNET_SET_OperationHandle *oh; | 382 | struct GNUNET_SET_OperationHandle *oh; |
383 | struct GNUNET_SET_Element e; | 383 | struct GNUNET_SET_Element e; |
384 | enum GNUNET_SET_Status result_status; | 384 | enum GNUNET_SET_Status result_status; |
385 | int destroy_set; | ||
385 | 386 | ||
386 | GNUNET_assert (NULL != set->mq); | 387 | GNUNET_assert (NULL != set->mq); |
387 | result_status = ntohs (msg->result_status); | 388 | result_status = ntohs (msg->result_status); |
@@ -422,6 +423,11 @@ do_final: | |||
422 | GNUNET_CONTAINER_DLL_remove (set->ops_head, | 423 | GNUNET_CONTAINER_DLL_remove (set->ops_head, |
423 | set->ops_tail, | 424 | set->ops_tail, |
424 | oh); | 425 | oh); |
426 | /* Need to do this calculation _before_ the result callback, | ||
427 | as IF the application still has a valid set handle, it | ||
428 | may trigger destruction of the set during the callback. */ | ||
429 | destroy_set = (GNUNET_YES == set->destroy_requested) && | ||
430 | (NULL == set->ops_head); | ||
425 | if (NULL != oh->result_cb) | 431 | if (NULL != oh->result_cb) |
426 | { | 432 | { |
427 | oh->result_cb (oh->result_cls, | 433 | oh->result_cb (oh->result_cls, |
@@ -433,8 +439,7 @@ do_final: | |||
433 | LOG (GNUNET_ERROR_TYPE_DEBUG, | 439 | LOG (GNUNET_ERROR_TYPE_DEBUG, |
434 | "No callback for final status\n"); | 440 | "No callback for final status\n"); |
435 | } | 441 | } |
436 | if ( (GNUNET_YES == set->destroy_requested) && | 442 | if (destroy_set) |
437 | (NULL == set->ops_head) ) | ||
438 | GNUNET_SET_destroy (set); | 443 | GNUNET_SET_destroy (set); |
439 | GNUNET_free (oh); | 444 | GNUNET_free (oh); |
440 | return; | 445 | return; |