Changeset 2310

Timestamp:

Jul 9, 2007, 4:30:20 PM (15 years ago)

Author:

charles

Message:

fix r2306 double-free crash reported by Gimp_, webaake

Location:

trunk/libtransmission

Files:

• list.c (modified) (7 diffs)
• list.h (modified) (1 diff)
• peermessages.h (modified) (1 diff)
• peerparse.h (modified) (1 diff)

trunk/libtransmission/list.c

@@ -13 +13 @@
 #include "utils.h"
 
-int
-tr_list_length( const tr_list_t * list )
-{
-    int i = 0;
-    while( list ) {
-        ++i;
-        list = list->next;
-    }
-    return i;
-}
-
-tr_list_t*
-tr_list_alloc( void )
+static tr_list_t*
+node_alloc( void )
 {
     return tr_new0( tr_list_t, 1 );
 }
 
-void
-tr_list_free1( tr_list_t* node )
+static void
+node_free( tr_list_t* node )
 {
     tr_free( node );
 }
+
+/***
+****
+***/
 
 void
@@ -43 +36 @@
         tr_list_t * node = list;
         list = list->next;
-        tr_list_free1( node );
+        node_free( node );
     }
 }
@@ -50 +43 @@
 tr_list_prepend( tr_list_t * list, void * data )
 {
-    tr_list_t * node = tr_list_alloc ();
+    tr_list_t * node = node_alloc ();
     node->data = data;
     node->next = list;
@@ -61 +54 @@
 tr_list_append( tr_list_t * list, void * data )
 {
-    tr_list_t * node = list;
-    tr_list_t * l = tr_list_alloc( );
-    l->data = data;
+    tr_list_t * node = node_alloc( );
+    node->data = data;
     if( !list )
-        return l;
-    while( node->next )
-        node = node->next;
-    node->next = l;
-    l->prev = node;
-    return list;
+        return node;
+    else {
+        tr_list_t * l = list;
+        while( l->next )
+            l = l->next;
+        l->next = node;
+        node->prev = l;
+        return list;
+    }
 }
 
@@ -84 +79 @@
 
 tr_list_t*
-tr_list_remove( tr_list_t * list, const void * data )
+tr_list_remove_data ( tr_list_t * list, const void * data )
 {
     tr_list_t * node = tr_list_find_data( list, data );
@@ -92 +87 @@
     if( next ) next->prev = prev;
     if( list == node ) list = next;
-    tr_list_free1( node );
+    node_free( node );
     return list;
 }
@@ -115 +110 @@
     }
 }
-

trunk/libtransmission/list.h

@@ -20 +20 @@
 tr_list_t;
 
-void        tr_list_free_1   ( void );
-void        tr_list_free     ( tr_list_t* );
-int         tr_list_length   ( const tr_list_t* );
-tr_list_t*  tr_list_append   ( tr_list_t*, void * data );
-tr_list_t*  tr_list_prepend  ( tr_list_t*, void * data );
-tr_list_t*  tr_list_remove   ( tr_list_t*, const void * data );
-tr_list_t*  tr_list_pop      ( tr_list_t*, void ** setme );
+void        tr_list_free        ( tr_list_t* );
+tr_list_t*  tr_list_append      ( tr_list_t*, void * data );
+tr_list_t*  tr_list_prepend     ( tr_list_t*, void * data );
+tr_list_t*  tr_list_remove_data ( tr_list_t*, const void * data );
+tr_list_t*  tr_list_pop         ( tr_list_t*, void ** setme );
 
 typedef int (*TrListCompareFunc)(const void * a, const void * b);
-tr_list_t*  tr_list_find      ( tr_list_t*, TrListCompareFunc func, const void * b );
-tr_list_t*  tr_list_find_data ( tr_list_t*, const void * data );
+tr_list_t*  tr_list_find        ( tr_list_t*, TrListCompareFunc func, const void * b );
+tr_list_t*  tr_list_find_data   ( tr_list_t*, const void * data );
 
 typedef void (*TrListForeachFunc)(void *);
-void tr_list_foreach( tr_list_t*, TrListForeachFunc func );
+void tr_list_foreach            ( tr_list_t*, TrListForeachFunc func );
 
 #endif /* TR_LIST_H */

trunk/libtransmission/peermessages.h

@@ -124 +124 @@
         r = (tr_request_t*) peer->outRequests->data;
         assert( r != NULL );
-        peer->outRequests = tr_list_remove( peer->outRequests, r );
+        peer->outRequests = tr_list_remove_data( peer->outRequests, r );
 
         if( !tr_cpPieceIsComplete( tor->completion, r->index ) ) /* sanity clause */

trunk/libtransmission/peerparse.h

@@ -418 +418 @@
     req.length = length;
     while(( l = tr_list_find( peer->outRequests, reqCompare, &req ) )) {
-        tr_free( l->data );
-        peer->outRequests = tr_list_remove( peer->outRequests, l );
+        tr_request_t * r = (tr_request_t *) l->data;
+        peer->outRequests = tr_list_remove_data( peer->outRequests, r );
+        tr_free( r );
     }