aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAris Adamantiadis <aris@0xbadc0de.be>2011-08-31 16:15:20 +0300
committerAris Adamantiadis <aris@0xbadc0de.be>2011-09-02 11:43:12 +0300
commitb5351f2809140921076ef54cc6092b543b5199d2 (patch)
tree2152e9150f85300c2dc7c5d6bb178a2bf1a28354
parentd1ebc4697a9fa54403a2e6a55b6245c3200fb1e5 (diff)
downloadlibssh-b5351f2809140921076ef54cc6092b543b5199d2.tar.gz
libssh-b5351f2809140921076ef54cc6092b543b5199d2.tar.xz
libssh-b5351f2809140921076ef54cc6092b543b5199d2.zip
poll: resolve use-after-free + inconsistent callbacks call
This code was weird in the first place. I suspect my change will break something else (probably the appcode that needed it). ssh_poll_ctx_free is not a good place to send exception callbacks imho.
-rw-r--r--src/poll.c21
1 files changed, 3 insertions, 18 deletions
diff --git a/src/poll.c b/src/poll.c
index 4fb63ad8..70a6fdb7 100644
--- a/src/poll.c
+++ b/src/poll.c
@@ -443,24 +443,9 @@ ssh_poll_ctx ssh_poll_ctx_new(size_t chunk_size) {
*/
void ssh_poll_ctx_free(ssh_poll_ctx ctx) {
if (ctx->polls_allocated > 0) {
- register size_t i, used;
-
- used = ctx->polls_used;
- for (i = 0; i < used; ) {
- ssh_poll_handle p = ctx->pollptrs[i];
- socket_t fd = ctx->pollfds[i].fd;
-
- /* force poll object removal */
- if (p->cb && p->cb(p, fd, POLLERR, p->cb_data) < 0) {
- if(ctx->polls_used < used) {
- used = ctx->polls_used;
- } else {
- /* nothing to do */
- i++;
- }
- } else {
- i++;
- }
+ while (ctx->polls_used > 0){
+ ssh_poll_handle p = ctx->pollptrs[0];
+ ssh_poll_ctx_remove(ctx, p);
}
SAFE_FREE(ctx->pollptrs);