From ML:

Hey,

I'm debugging a problem with a crash in MHD_select_thread.  We had
MHD_start_daemon_va fail while creating worker threads with the following
error: "file descriptor for worker control pipe exceeds maximum value".  We
know what caused this error and are fixing it.  But the problem was that a
MHD_select_thread worker thread was left running in the background after
MHD_start_daemon_va returned failure.  I think the problem is from this
code in the thread_failed case in daemon.c:

  /* Shutdown worker threads we've already created. Pretend
     as though we had fully initialized our daemon, but
     with a smaller number of threads than had been
     requested. */
  daemon->worker_pool_size = i - 1;
  MHD_stop_daemon (daemon);
  return NULL;

From the code, it looks like "i" is actually the number of threads that
were successfully created, so the "i - 1" in this code will leave an extra
thread hanging since MHD_stop_daemon will clean up one less thread than it
should.  I'll probably try to work up a test to verify removing the "- 1"
is correct, but that could take me some time so I wanted to make sure I
wasn't missing something obvious before heading down that path.

~JareD

He is right, this patch fixes it.

3 files changed, 7 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 657ee00c..cbd5ea38 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Wed May 13 11:33:59 CEST 2015
+        Fix off-by-one in MHD_start_daemon_va() error handling logic
+        when initialization of threads for thread pool fails for some
+        reason. -CG/JC
+
 Thu May  7 17:05:46 CEST 2015
         Add support for poll() in W32. -EG
 
diff --git a/src/include/microhttpd.h b/src/include/microhttpd.h
index a9aae2fe..f6157bee 100644
--- a/src/include/microhttpd.h
+++ b/src/include/microhttpd.h
@@ -130,7 +130,7 @@ typedef intptr_t ssize_t;
  * Current version of the library.
  * 0x01093001 = 1.9.30-1.
  */
-#define MHD_VERSION 0x00094102
+#define MHD_VERSION 0x00094103
 
 /**
  * MHD-internal return code for "YES".
diff --git a/src/microhttpd/daemon.c b/src/microhttpd/daemon.c
index 53b2cee7..1aa7d8d3 100644
--- a/src/microhttpd/daemon.c
+++ b/src/microhttpd/daemon.c
@@ -4265,7 +4265,7 @@ thread_failed:
      as though we had fully initialized our daemon, but
      with a smaller number of threads than had been
      requested. */
-  daemon->worker_pool_size = i - 1;
+  daemon->worker_pool_size = i;
   MHD_stop_daemon (daemon);
   return NULL;