diff options
author | Nick Mathewson <nickm@torproject.org> | 2011-07-07 11:00:21 -0400 |
---|---|---|
committer | Nick Mathewson <nickm@torproject.org> | 2011-07-07 11:00:21 -0400 |
commit | 57822cbbbe85410785716fa62667b674b35602df (patch) | |
tree | 7b51de7517525d01e304cb762cbab1a26a12e1a9 /src | |
parent | f883ec09b5b2f48cd4186658e0b92f1511358f21 (diff) | |
download | tor-57822cbbbe85410785716fa62667b674b35602df.tar tor-57822cbbbe85410785716fa62667b674b35602df.tar.gz |
Avoid double-free in bufferevent read/write cbs
Fixes bug 3404; bugfix on 0.2.3.1-alpha.
Diffstat (limited to 'src')
-rw-r--r-- | src/or/connection.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/or/connection.c b/src/or/connection.c index e8969e09f..c84ee04d5 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2957,9 +2957,11 @@ connection_handle_read_cb(struct bufferevent *bufev, void *arg) { connection_t *conn = arg; (void) bufev; - if (!conn->marked_for_close) + if (!conn->marked_for_close) { if (connection_process_inbuf(conn, 1)<0) /* XXXX Always 1? */ - connection_mark_for_close(conn); + if (!conn->marked_for_close) + connection_mark_for_close(conn); + } } /** Callback: invoked whenever a bufferevent has written data. */ @@ -2969,7 +2971,8 @@ connection_handle_write_cb(struct bufferevent *bufev, void *arg) connection_t *conn = arg; struct evbuffer *output; if (connection_flushed_some(conn)<0) { - connection_mark_for_close(conn); + if (!conn->marked_for_close) + connection_mark_for_close(conn); return; } |