diff options
| author | Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com> | 2013-01-28 15:43:11 +0200 |
|---|---|---|
| committer | Patrik Flykt <patrik.flykt@linux.intel.com> | 2013-01-28 16:18:28 +0200 |
| commit | fd0bc5cdfaa1d0bf6abf32e71abde45f581572ee (patch) | |
| tree | c5e7a47aaa2455cab3e56b5bcc845bafe475bc74 | |
| parent | 82c0faebfe4df59c8722271874e83a0db4ceefef (diff) | |
| download | connman-fd0bc5cdfaa1d0bf6abf32e71abde45f581572ee.tar.gz connman-fd0bc5cdfaa1d0bf6abf32e71abde45f581572ee.tar.bz2 connman-fd0bc5cdfaa1d0bf6abf32e71abde45f581572ee.zip | |
gresolv: Destroy query at the relevant place when parsing the response
parse_response() will eventually call sort_and_return_results() which in turn
will call the result function. But the result function might cancel the gresolv.
At that point all queries belonging to this gresolv are destroyed. Returning back
to parse_response(), it calls again destroy_query() on an already destroyed one.
Thus leading to a crash.
Same issue with query_timeout()
Reported by Daniel Wagner
| -rw-r--r-- | gweb/gresolv.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/gweb/gresolv.c b/gweb/gresolv.c index 322299a7..71b70dc7 100644 --- a/gweb/gresolv.c +++ b/gweb/gresolv.c @@ -539,12 +539,11 @@ static gboolean query_timeout(gpointer user_data) } g_queue_remove(resolv->query_queue, query); + destroy_query(query); if (lookup->ipv4_query == NULL && lookup->ipv6_query == NULL) sort_and_return_results(lookup); - destroy_query(query); - return FALSE; } @@ -731,11 +730,10 @@ static void parse_response(struct resolv_nameserver *nameserver, } g_queue_remove(resolv->query_queue, query); + destroy_query(query); if (lookup->ipv4_query == NULL && lookup->ipv6_query == NULL) sort_and_return_results(lookup); - - destroy_query(query); } static gboolean received_udp_data(GIOChannel *channel, GIOCondition cond, |