Changeset 1905

Timestamp:

Apr 2, 2008 6:36:35 PM (16 years ago)

Author:

bennylp

Message:

Ticket #520: Race condition may cause ioqueue corruption (thanks Philippe Leuba)

Location:

pjproject/trunk/pjlib

Files:

• include/pj/list_i.h (modified) (1 diff)
• src/pj/ioqueue_select.c (modified) (1 diff)

pjproject/trunk/pjlib/include/pj/list_i.h

@@ -76 +76 @@
 {
     pj_link_node( ((pj_list*)node)->prev, ((pj_list*)node)->next);
+
+    /* It'll be safer to init the next/prev fields to itself, to
+     * prevent multiple erase() from corrupting the list. See
+     * ticket #520 for one sample bug.
+     */
+    pj_list_init(node);
 }
 

pjproject/trunk/pjlib/src/pj/ioqueue_select.c

@@ -446 +446 @@
     pj_assert(ioqueue->count > 0);
     --ioqueue->count;
+#if !PJ_IOQUEUE_HAS_SAFE_UNREG
+    /* Ticket #520, key will be erased more than once */
     pj_list_erase(key);
+#endif
     PJ_FD_CLR(key->fd, &ioqueue->rfdset);
     PJ_FD_CLR(key->fd, &ioqueue->wfdset);