aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormilo <milo@r0ot.me>2011-04-20 04:13:01 +0200
committermilo <milo@r0ot.me>2011-04-20 05:05:07 +0200
commit56394917b15e41603c641c22a4e29c33b096d673 (patch)
tree0e80b1f6825bd254c9dafd8a7ef78bb96aa8a313
parent89d0fdbbde4cf48e783a8ee7c5907c51a83e207b (diff)
downloadlibssh-56394917b15e41603c641c22a4e29c33b096d673.tar.gz
libssh-56394917b15e41603c641c22a4e29c33b096d673.tar.xz
libssh-56394917b15e41603c641c22a4e29c33b096d673.zip
[socket] fix a segfault at disconnectbugfixes
-rw-r--r--src/socket.c19
1 files changed, 15 insertions, 4 deletions
diff --git a/src/socket.c b/src/socket.c
index 5097be9..a048bf8 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -234,8 +234,9 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
s->read_wontblock=1;
r=ssh_socket_unbuffered_read(s,buffer,sizeof(buffer));
if(r<0){
- if(p != NULL)
- ssh_poll_set_events(p,ssh_poll_get_events(p) & ~POLLIN);
+ if(p != NULL) {
+ ssh_poll_remove_events(p, POLLIN);
+ }
if(s->callbacks && s->callbacks->exception){
s->callbacks->exception(
SSH_SOCKET_EXCEPTION_ERROR,
@@ -243,7 +244,12 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
}
}
if(r==0){
- ssh_poll_set_events(p,ssh_poll_get_events(p) & ~POLLIN);
+ if(p != NULL) {
+ ssh_poll_remove_events(p, POLLIN);
+ }
+ if(p != NULL) {
+ ssh_poll_remove_events(p, POLLIN);
+ }
if(s->callbacks && s->callbacks->exception){
s->callbacks->exception(
SSH_SOCKET_EXCEPTION_EOF,
@@ -258,6 +264,9 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
buffer_get_rest_len(s->in_buffer),
s->callbacks->userdata);
buffer_pass_bytes(s->in_buffer,r);
+ /* p may have been freed, so don't use it
+ * anymore in this function */
+ p = NULL;
}
}
}
@@ -278,7 +287,9 @@ int ssh_socket_pollcallback(struct ssh_poll_handle_struct *p, socket_t fd, int r
}
/* So, we can write data */
s->write_wontblock=1;
- ssh_poll_remove_events(p,POLLOUT);
+ if(p != NULL) {
+ ssh_poll_remove_events(p, POLLOUT);
+ }
/* If buffered data is pending, write it */
if(buffer_get_rest_len(s->out_buffer) > 0){