diff options
| author | Nick Mathewson <nickm@torproject.org> | 2011-07-07 11:00:21 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2011-07-07 11:00:21 -0400 |
| commit | 57822cbbbe85410785716fa62667b674b35602df (patch) | |
| tree | 7b51de7517525d01e304cb762cbab1a26a12e1a9 | |
| parent | f883ec09b5b2f48cd4186658e0b92f1511358f21 (diff) | |
| download | tor-57822cbbbe85410785716fa62667b674b35602df.tar.gz tor-57822cbbbe85410785716fa62667b674b35602df.zip | |
Avoid double-free in bufferevent read/write cbs
Fixes bug 3404; bugfix on 0.2.3.1-alpha.
| -rw-r--r-- | changes/bug3404 | 3 | ||||
| -rw-r--r-- | src/or/connection.c | 9 |
2 files changed, 9 insertions, 3 deletions
diff --git a/changes/bug3404 b/changes/bug3404 new file mode 100644 index 0000000000..4e2e21bc02 --- /dev/null +++ b/changes/bug3404 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix a class of double-mark-for-close bugs when bufferevents + are enabled. Fixes bug 3404; bugfix on 0.2.3.1-alpha. diff --git a/src/or/connection.c b/src/or/connection.c index e8969e09fc..c84ee04d54 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2957,9 +2957,11 @@ connection_handle_read_cb(struct bufferevent *bufev, void *arg) { connection_t *conn = arg; (void) bufev; - if (!conn->marked_for_close) + if (!conn->marked_for_close) { if (connection_process_inbuf(conn, 1)<0) /* XXXX Always 1? */ - connection_mark_for_close(conn); + if (!conn->marked_for_close) + connection_mark_for_close(conn); + } } /** Callback: invoked whenever a bufferevent has written data. */ @@ -2969,7 +2971,8 @@ connection_handle_write_cb(struct bufferevent *bufev, void *arg) connection_t *conn = arg; struct evbuffer *output; if (connection_flushed_some(conn)<0) { - connection_mark_for_close(conn); + if (!conn->marked_for_close) + connection_mark_for_close(conn); return; } |