Mercurial > pidgin3 / changeset

• changeset
• raw

changeset

Fix a crash Jacky Lam noted on devel@pidgin.im:

Mon, 17 Nov 2008 19:30:27 +0000

author

Richard Laager <rlaager@pidgin.im>

date

Mon, 17 Nov 2008 19:30:27 +0000

changeset 24701

777f269be1b0

parent 24700

8ed981baeb92

child 24702

55805ee6a45b

child 24704

b74f07d90d43

Fix a crash Jacky Lam noted on devel@pidgin.im:
Currently, I experience crash at dnsquery.c:purple_dnsquery_destroy()
when my WiFi AP suddenly off while I am online with libpurple.

After tracing, I find the data struct PurpleDnsQueryData is freeing
twice. The reason is when purple_dnsquery_failed() is called,
purple_dnsquery_destroy() will try to free the PurpleDnsQueryData's
resolver and itself. But purple_dnsquery_resolver_destroy()'s kill()
will trigger the glib's input hook and finally called host_resolved()
and eventually call purple_dnsquery_failed() again!!

--- a/COPYRIGHT	Mon Nov 17 19:28:39 2008 +0000
+++ b/COPYRIGHT	Mon Nov 17 19:30:27 2008 +0000
@@ -220,6 +220,7 @@
 Tuomas Kuosmanen
 Tero Kuusela
 Richard Laager
+Jacky Lam
 Scott Lamb
 Dennis Lambe Jr.
 Joe LaPenna

--- a/libpurple/dnsquery.c	Mon Nov 17 19:28:39 2008 +0000
+++ b/libpurple/dnsquery.c	Mon Nov 17 19:30:27 2008 +0000
@@ -345,6 +345,12 @@
 {
 	g_return_if_fail(resolver != NULL);
 
+	/* Keep this before the kill() call below. */
+	if (resolver->inpa != 0) {
+		purple_input_remove(resolver->inpa);
+		resolver->inpa = 0;
+	}
+
 	/*
 	 * We might as well attempt to kill our child process.  It really
 	 * doesn't matter if this fails, because children will expire on
@@ -353,9 +359,6 @@
 	if (resolver->dns_pid > 0)
 		kill(resolver->dns_pid, SIGKILL);
 
-	if (resolver->inpa != 0)
-		purple_input_remove(resolver->inpa);
-
 	close(resolver->fd_in);
 	close(resolver->fd_out);