From ee38b3da973765ede32f452fe425c82debf582f6 Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Tue, 5 Apr 2005 01:51:09 +0000 Subject: [PATCH] Patch from Miyotaka Sakai to fix access to free area defect 426. (Logical change 1.168) git-svn-id: http://svn.fedorahosted.org/svn/corosync/trunk@575 fd59a12c-fef9-0310-b244-a6a79926bd2f --- exec/totemsrp.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/exec/totemsrp.c b/exec/totemsrp.c index a04355fa..faa2b27f 100644 --- a/exec/totemsrp.c +++ b/exec/totemsrp.c @@ -2740,6 +2740,7 @@ void totemsrp_callback_token_destroy (void **handle_out) h = (struct token_callback_instance *)*handle_out; list_del (&h->list); free (h); + h = NULL; *handle_out = 0; } } @@ -2759,6 +2760,7 @@ void token_callbacks_execute (enum totem_callback_token_type type) struct list_head *callback_listhead = 0; struct token_callback_instance *token_callback_instance; int res; + int del; switch (type) { case TOTEM_CALLBACK_TOKEN_RECEIVED: @@ -2775,22 +2777,22 @@ void token_callbacks_execute (enum totem_callback_token_type type) list = list_next) { token_callback_instance = list_entry (list, struct token_callback_instance, list); + list_next = list->next; - if (token_callback_instance->delete == 1) { + del = token_callback_instance->delete; + if (del == 1) { list_del (list); } res = token_callback_instance->callback_fn ( token_callback_instance->callback_type, token_callback_instance->data); - /* * This callback failed to execute, try it again on the next token */ - if (res == -1 && token_callback_instance->delete == 1) { + if (res == -1 && del == 1) { list_add (list, callback_listhead); - } else - if (token_callback_instance->delete) { + } else if (del) { free (token_callback_instance); } }