diff options
author | Aris Adamantiadis <aris@0xbadc0de.be> | 2011-08-31 16:15:20 +0300 |
---|---|---|
committer | Aris Adamantiadis <aris@0xbadc0de.be> | 2011-09-02 11:43:12 +0300 |
commit | b5351f2809140921076ef54cc6092b543b5199d2 (patch) | |
tree | 2152e9150f85300c2dc7c5d6bb178a2bf1a28354 /src | |
parent | d1ebc4697a9fa54403a2e6a55b6245c3200fb1e5 (diff) | |
download | libssh-b5351f2809140921076ef54cc6092b543b5199d2.tar.gz libssh-b5351f2809140921076ef54cc6092b543b5199d2.tar.xz libssh-b5351f2809140921076ef54cc6092b543b5199d2.zip |
poll: resolve use-after-free + inconsistent callbacks call
This code was weird in the first place. I suspect my change will break something else
(probably the appcode that needed it). ssh_poll_ctx_free is not a good
place to send exception callbacks imho.
Diffstat (limited to 'src')
-rw-r--r-- | src/poll.c | 21 |
1 files changed, 3 insertions, 18 deletions
@@ -443,24 +443,9 @@ ssh_poll_ctx ssh_poll_ctx_new(size_t chunk_size) { */ void ssh_poll_ctx_free(ssh_poll_ctx ctx) { if (ctx->polls_allocated > 0) { - register size_t i, used; - - used = ctx->polls_used; - for (i = 0; i < used; ) { - ssh_poll_handle p = ctx->pollptrs[i]; - socket_t fd = ctx->pollfds[i].fd; - - /* force poll object removal */ - if (p->cb && p->cb(p, fd, POLLERR, p->cb_data) < 0) { - if(ctx->polls_used < used) { - used = ctx->polls_used; - } else { - /* nothing to do */ - i++; - } - } else { - i++; - } + while (ctx->polls_used > 0){ + ssh_poll_handle p = ctx->pollptrs[0]; + ssh_poll_ctx_remove(ctx, p); } SAFE_FREE(ctx->pollptrs); |