diff options
| author | Stefan Metzmacher <metze@samba.org> | 2014-01-11 08:58:05 +0100 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2014-01-17 12:38:08 +0100 |
| commit | 7fe5584e2a59584431cb2ddf8a4da22bfb924454 (patch) | |
| tree | 421702c21a51c27b7817405e9a5da9382e6d1b0c /lib/tevent | |
| parent | b7bfe46636d07c71f83daff884ec339c9b4aee72 (diff) | |
| download | samba-7fe5584e2a59584431cb2ddf8a4da22bfb924454.tar.gz | |
tevent: fix crash bug in tevent_queue_immediate_trigger()
Assume we we have a queue with 2 entries (A and B with triggerA() and triggerB()).
If triggerA() removes itself tevent_queue_entry_destructor() will be called
for A, this schedules the immediate event to call triggerB().
If triggerA() then also removes B by an explicit of implizit talloc_free(),
q->list is NULL, but the immediate event is still scheduled and can't be unscheduled.
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Diffstat (limited to 'lib/tevent')
| -rw-r--r-- | lib/tevent/tevent_queue.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/lib/tevent/tevent_queue.c b/lib/tevent/tevent_queue.c index 930319c2262..35742e595f5 100644 --- a/lib/tevent/tevent_queue.c +++ b/lib/tevent/tevent_queue.c @@ -141,6 +141,10 @@ static void tevent_queue_immediate_trigger(struct tevent_context *ev, return; } + if (!q->list) { + return; + } + q->list->triggered = true; q->list->trigger(q->list->req, q->list->private_data); } |