Changeset 2310


Ignore:
Timestamp:
Jul 9, 2007, 4:30:20 PM (15 years ago)
Author:
charles
Message:

fix r2306 double-free crash reported by Gimp_, webaake

Location:
trunk/libtransmission
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • trunk/libtransmission/list.c

    r2306 r2310  
    1313#include "utils.h"
    1414
    15 int
    16 tr_list_length( const tr_list_t * list )
    17 {
    18     int i = 0;
    19     while( list ) {
    20         ++i;
    21         list = list->next;
    22     }
    23     return i;
    24 }
    25 
    26 tr_list_t*
    27 tr_list_alloc( void )
     15static tr_list_t*
     16node_alloc( void )
    2817{
    2918    return tr_new0( tr_list_t, 1 );
    3019}
    3120
    32 void
    33 tr_list_free1( tr_list_t* node )
     21static void
     22node_free( tr_list_t* node )
    3423{
    3524    tr_free( node );
    3625}
     26
     27/***
     28****
     29***/
    3730
    3831void
     
    4336        tr_list_t * node = list;
    4437        list = list->next;
    45         tr_list_free1( node );
     38        node_free( node );
    4639    }
    4740}
     
    5043tr_list_prepend( tr_list_t * list, void * data )
    5144{
    52     tr_list_t * node = tr_list_alloc ();
     45    tr_list_t * node = node_alloc ();
    5346    node->data = data;
    5447    node->next = list;
     
    6154tr_list_append( tr_list_t * list, void * data )
    6255{
    63     tr_list_t * node = list;
    64     tr_list_t * l = tr_list_alloc( );
    65     l->data = data;
     56    tr_list_t * node = node_alloc( );
     57    node->data = data;
    6658    if( !list )
    67         return l;
    68     while( node->next )
    69         node = node->next;
    70     node->next = l;
    71     l->prev = node;
    72     return list;
     59        return node;
     60    else {
     61        tr_list_t * l = list;
     62        while( l->next )
     63            l = l->next;
     64        l->next = node;
     65        node->prev = l;
     66        return list;
     67    }
    7368}
    7469
     
    8479
    8580tr_list_t*
    86 tr_list_remove( tr_list_t * list, const void * data )
     81tr_list_remove_data ( tr_list_t * list, const void * data )
    8782{
    8883    tr_list_t * node = tr_list_find_data( list, data );
     
    9287    if( next ) next->prev = prev;
    9388    if( list == node ) list = next;
    94     tr_list_free1( node );
     89    node_free( node );
    9590    return list;
    9691}
     
    115110    }
    116111}
    117 
  • trunk/libtransmission/list.h

    r2306 r2310  
    2020tr_list_t;
    2121
    22 void        tr_list_free_1   ( void );
    23 void        tr_list_free     ( tr_list_t* );
    24 int         tr_list_length   ( const tr_list_t* );
    25 tr_list_t*  tr_list_append   ( tr_list_t*, void * data );
    26 tr_list_t*  tr_list_prepend  ( tr_list_t*, void * data );
    27 tr_list_t*  tr_list_remove   ( tr_list_t*, const void * data );
    28 tr_list_t*  tr_list_pop      ( tr_list_t*, void ** setme );
     22void        tr_list_free        ( tr_list_t* );
     23tr_list_t*  tr_list_append      ( tr_list_t*, void * data );
     24tr_list_t*  tr_list_prepend     ( tr_list_t*, void * data );
     25tr_list_t*  tr_list_remove_data ( tr_list_t*, const void * data );
     26tr_list_t*  tr_list_pop         ( tr_list_t*, void ** setme );
    2927
    3028typedef int (*TrListCompareFunc)(const void * a, const void * b);
    31 tr_list_t*  tr_list_find      ( tr_list_t*, TrListCompareFunc func, const void * b );
    32 tr_list_t*  tr_list_find_data ( tr_list_t*, const void * data );
     29tr_list_t*  tr_list_find        ( tr_list_t*, TrListCompareFunc func, const void * b );
     30tr_list_t*  tr_list_find_data   ( tr_list_t*, const void * data );
    3331
    3432typedef void (*TrListForeachFunc)(void *);
    35 void tr_list_foreach( tr_list_t*, TrListForeachFunc func );
     33void tr_list_foreach            ( tr_list_t*, TrListForeachFunc func );
    3634
    3735#endif /* TR_LIST_H */
  • trunk/libtransmission/peermessages.h

    r2306 r2310  
    124124        r = (tr_request_t*) peer->outRequests->data;
    125125        assert( r != NULL );
    126         peer->outRequests = tr_list_remove( peer->outRequests, r );
     126        peer->outRequests = tr_list_remove_data( peer->outRequests, r );
    127127
    128128        if( !tr_cpPieceIsComplete( tor->completion, r->index ) ) /* sanity clause */
  • trunk/libtransmission/peerparse.h

    r2306 r2310  
    418418    req.length = length;
    419419    while(( l = tr_list_find( peer->outRequests, reqCompare, &req ) )) {
    420         tr_free( l->data );
    421         peer->outRequests = tr_list_remove( peer->outRequests, l );
     420        tr_request_t * r = (tr_request_t *) l->data;
     421        peer->outRequests = tr_list_remove_data( peer->outRequests, r );
     422        tr_free( r );
    422423    }
    423424
Note: See TracChangeset for help on using the changeset viewer.