diff options
author | Christian Grothoff <christian@grothoff.org> | 2010-11-18 21:51:59 +0000 |
---|---|---|
committer | Christian Grothoff <christian@grothoff.org> | 2010-11-18 21:51:59 +0000 |
commit | 264a2b7bf9224a9c13a62923c7c5de9635bc417a (patch) | |
tree | 78f9cd86a45c1233c73d67988928d27172cdb485 /src/transport/transport_api.c | |
parent | 1121afe173945645761e6853234f82b1ec14dc8e (diff) | |
download | gnunet-264a2b7bf9224a9c13a62923c7c5de9635bc417a.tar.gz gnunet-264a2b7bf9224a9c13a62923c7c5de9635bc417a.zip |
extra asserts for 1618, fixing one minor, likely unrelated use-after-free
Diffstat (limited to 'src/transport/transport_api.c')
-rw-r--r-- | src/transport/transport_api.c | 59 |
1 files changed, 35 insertions, 24 deletions
diff --git a/src/transport/transport_api.c b/src/transport/transport_api.c index 6fb35b5d6..8c47b0936 100644 --- a/src/transport/transport_api.c +++ b/src/transport/transport_api.c | |||
@@ -436,6 +436,7 @@ schedule_peer_transmission (struct GNUNET_TRANSPORT_Handle *h) | |||
436 | struct NeighbourList *next; | 436 | struct NeighbourList *next; |
437 | struct GNUNET_TIME_Relative retry_time; | 437 | struct GNUNET_TIME_Relative retry_time; |
438 | struct GNUNET_TIME_Relative duration; | 438 | struct GNUNET_TIME_Relative duration; |
439 | GNUNET_CONNECTION_TransmitReadyNotify notify; | ||
439 | 440 | ||
440 | if (h->quota_task != GNUNET_SCHEDULER_NO_TASK) | 441 | if (h->quota_task != GNUNET_SCHEDULER_NO_TASK) |
441 | { | 442 | { |
@@ -474,8 +475,11 @@ schedule_peer_transmission (struct GNUNET_TRANSPORT_Handle *h) | |||
474 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; | 475 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; |
475 | } | 476 | } |
476 | n->transmit_stage = TS_NEW; | 477 | n->transmit_stage = TS_NEW; |
477 | if (NULL != th->notify) | 478 | if (NULL != (notify = th->notify)) |
478 | GNUNET_assert (0 == th->notify (th->notify_cls, 0, NULL)); | 479 | { |
480 | th->notify = NULL; | ||
481 | GNUNET_assert (0 == notify (th->notify_cls, 0, NULL)); | ||
482 | } | ||
479 | continue; | 483 | continue; |
480 | } | 484 | } |
481 | if (duration.rel_value > 0) | 485 | if (duration.rel_value > 0) |
@@ -527,6 +531,7 @@ transport_notify_ready (void *cls, size_t size, void *buf) | |||
527 | struct GNUNET_TRANSPORT_TransmitHandle *th; | 531 | struct GNUNET_TRANSPORT_TransmitHandle *th; |
528 | struct NeighbourList *n; | 532 | struct NeighbourList *n; |
529 | struct OutboundMessage obm; | 533 | struct OutboundMessage obm; |
534 | GNUNET_CONNECTION_TransmitReadyNotify notify; | ||
530 | size_t ret; | 535 | size_t ret; |
531 | size_t mret; | 536 | size_t mret; |
532 | size_t nret; | 537 | size_t nret; |
@@ -593,9 +598,11 @@ transport_notify_ready (void *cls, size_t size, void *buf) | |||
593 | GNUNET_break (0); | 598 | GNUNET_break (0); |
594 | } | 599 | } |
595 | GNUNET_assert (size >= sizeof (struct OutboundMessage)); | 600 | GNUNET_assert (size >= sizeof (struct OutboundMessage)); |
596 | mret = th->notify (th->notify_cls, | 601 | notify = th->notify; |
597 | size - sizeof (struct OutboundMessage), | 602 | th->notify = NULL; |
598 | &cbuf[ret + sizeof (struct OutboundMessage)]); | 603 | mret = notify (th->notify_cls, |
604 | size - sizeof (struct OutboundMessage), | ||
605 | &cbuf[ret + sizeof (struct OutboundMessage)]); | ||
599 | GNUNET_assert (mret <= size - sizeof (struct OutboundMessage)); | 606 | GNUNET_assert (mret <= size - sizeof (struct OutboundMessage)); |
600 | #if DEBUG_TRANSPORT | 607 | #if DEBUG_TRANSPORT |
601 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, | 608 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, |
@@ -714,8 +721,8 @@ control_transmit_timeout (void *cls, | |||
714 | struct ControlMessage *th = cls; | 721 | struct ControlMessage *th = cls; |
715 | 722 | ||
716 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; | 723 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; |
717 | if (NULL != th->notify) | 724 | if (NULL != th->notify) |
718 | th->notify (th->notify_cls, 0, NULL); | 725 | th->notify (th->notify_cls, 0, NULL); |
719 | GNUNET_CONTAINER_DLL_remove (th->h->control_head, | 726 | GNUNET_CONTAINER_DLL_remove (th->h->control_head, |
720 | th->h->control_tail, | 727 | th->h->control_tail, |
721 | th); | 728 | th); |
@@ -743,29 +750,29 @@ schedule_control_transmit (struct GNUNET_TRANSPORT_Handle *h, | |||
743 | GNUNET_CONNECTION_TransmitReadyNotify notify, | 750 | GNUNET_CONNECTION_TransmitReadyNotify notify, |
744 | void *notify_cls) | 751 | void *notify_cls) |
745 | { | 752 | { |
746 | struct ControlMessage *th; | 753 | struct ControlMessage *cm; |
747 | 754 | ||
748 | #if DEBUG_TRANSPORT | 755 | #if DEBUG_TRANSPORT |
749 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, | 756 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, |
750 | "Control transmit of %u bytes within %llums requested\n", | 757 | "Control transmit of %u bytes within %llums requested\n", |
751 | size, (unsigned long long) timeout.rel_value); | 758 | size, (unsigned long long) timeout.rel_value); |
752 | #endif | 759 | #endif |
753 | th = GNUNET_malloc (sizeof (struct ControlMessage)); | 760 | cm = GNUNET_malloc (sizeof (struct ControlMessage)); |
754 | th->h = h; | 761 | cm->h = h; |
755 | th->notify = notify; | 762 | cm->notify = notify; |
756 | th->notify_cls = notify_cls; | 763 | cm->notify_cls = notify_cls; |
757 | th->notify_size = size; | 764 | cm->notify_size = size; |
758 | th->notify_delay_task | 765 | cm->notify_delay_task |
759 | = GNUNET_SCHEDULER_add_delayed (timeout, &control_transmit_timeout, th); | 766 | = GNUNET_SCHEDULER_add_delayed (timeout, &control_transmit_timeout, cm); |
760 | if (at_head) | 767 | if (at_head) |
761 | GNUNET_CONTAINER_DLL_insert (h->control_head, | 768 | GNUNET_CONTAINER_DLL_insert (h->control_head, |
762 | h->control_tail, | 769 | h->control_tail, |
763 | th); | 770 | cm); |
764 | else | 771 | else |
765 | GNUNET_CONTAINER_DLL_insert_after (h->control_head, | 772 | GNUNET_CONTAINER_DLL_insert_after (h->control_head, |
766 | h->control_tail, | 773 | h->control_tail, |
767 | h->control_tail, | 774 | h->control_tail, |
768 | th); | 775 | cm); |
769 | schedule_transmission (h); | 776 | schedule_transmission (h); |
770 | } | 777 | } |
771 | 778 | ||
@@ -1086,6 +1093,7 @@ neighbour_free (struct NeighbourList *n) | |||
1086 | struct NeighbourList *prev; | 1093 | struct NeighbourList *prev; |
1087 | struct NeighbourList *pos; | 1094 | struct NeighbourList *pos; |
1088 | 1095 | ||
1096 | GNUNET_assert (n->th->notify == NULL); | ||
1089 | h = n->h; | 1097 | h = n->h; |
1090 | #if DEBUG_TRANSPORT | 1098 | #if DEBUG_TRANSPORT |
1091 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, | 1099 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, |
@@ -1128,8 +1136,9 @@ neighbour_disconnect (struct NeighbourList *n) | |||
1128 | n->is_connected = GNUNET_NO; | 1136 | n->is_connected = GNUNET_NO; |
1129 | if (h->nd_cb != NULL) | 1137 | if (h->nd_cb != NULL) |
1130 | h->nd_cb (h->cls, &n->id); | 1138 | h->nd_cb (h->cls, &n->id); |
1131 | if (n->transmit_stage == TS_NEW) | 1139 | if (n->transmit_stage == TS_NEW) |
1132 | neighbour_free (n); | 1140 | neighbour_free (n); |
1141 | |||
1133 | } | 1142 | } |
1134 | 1143 | ||
1135 | 1144 | ||
@@ -1286,7 +1295,8 @@ send_transport_request_connect (void *cls, size_t size, void *buf) | |||
1286 | * @param n the neighbor to send the request connect message about | 1295 | * @param n the neighbor to send the request connect message about |
1287 | * | 1296 | * |
1288 | */ | 1297 | */ |
1289 | static void send_request_connect_message(struct GNUNET_TRANSPORT_Handle *h, struct NeighbourList *n) | 1298 | static void |
1299 | send_request_connect_message(struct GNUNET_TRANSPORT_Handle *h, struct NeighbourList *n) | ||
1290 | { | 1300 | { |
1291 | struct TransportRequestConnectMessage *trcm; | 1301 | struct TransportRequestConnectMessage *trcm; |
1292 | 1302 | ||
@@ -1859,6 +1869,7 @@ GNUNET_TRANSPORT_notify_transmit_ready_cancel (struct | |||
1859 | { | 1869 | { |
1860 | struct NeighbourList *n; | 1870 | struct NeighbourList *n; |
1861 | 1871 | ||
1872 | th->notify = NULL; | ||
1862 | n = th->neighbour; | 1873 | n = th->neighbour; |
1863 | #if DEBUG_TRANSPORT | 1874 | #if DEBUG_TRANSPORT |
1864 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, | 1875 | GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, |
@@ -1866,6 +1877,11 @@ GNUNET_TRANSPORT_notify_transmit_ready_cancel (struct | |||
1866 | th->notify_size - sizeof (struct OutboundMessage), | 1877 | th->notify_size - sizeof (struct OutboundMessage), |
1867 | GNUNET_i2s (&n->id)); | 1878 | GNUNET_i2s (&n->id)); |
1868 | #endif | 1879 | #endif |
1880 | if (th->notify_delay_task != GNUNET_SCHEDULER_NO_TASK) | ||
1881 | { | ||
1882 | GNUNET_SCHEDULER_cancel (th->notify_delay_task); | ||
1883 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; | ||
1884 | } | ||
1869 | switch (n->transmit_stage) | 1885 | switch (n->transmit_stage) |
1870 | { | 1886 | { |
1871 | case TS_NEW: | 1887 | case TS_NEW: |
@@ -1885,11 +1901,6 @@ GNUNET_TRANSPORT_notify_transmit_ready_cancel (struct | |||
1885 | default: | 1901 | default: |
1886 | GNUNET_break (0); | 1902 | GNUNET_break (0); |
1887 | } | 1903 | } |
1888 | if (th->notify_delay_task != GNUNET_SCHEDULER_NO_TASK) | ||
1889 | { | ||
1890 | GNUNET_SCHEDULER_cancel (th->notify_delay_task); | ||
1891 | th->notify_delay_task = GNUNET_SCHEDULER_NO_TASK; | ||
1892 | } | ||
1893 | } | 1904 | } |
1894 | 1905 | ||
1895 | 1906 | ||