Patches item #1104800, was opened at 2005-01-18 15:49
Message generated for change (Comment added) made by nosnilmot
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=300235&aid=1104800&group_id=235
Category: None
Group: None
>Status: Pending
Resolution: None
Priority: 5
Submitted By: Evan Schoenberg (evands)
Assigned to: Stu Tomlinson (nosnilmot)
Summary: [MSN] msn_switchboard_destroy() crash fix
Initial Comment:
This patch protects against this unusual
msn_switchboard_destroy() crash:
0 Libgaim 0x0576c9c8 g_queue_pop_head +
0x64
1 Libgaim 0x0572042c
msn_switchboard_destroy + 0xb0
2 Libgaim 0x05719644
msn_servconn_destroy + 0x98
3 Libgaim 0x05719ef8 read_cb + 0x188
by ensuring that swboard->msg_queue != NULL before attempting
to call g_queue_pop_head on it.
----------------------------------------------------------------------
>Comment By: Stu Tomlinson (nosnilmot)
Date: 2005-01-20 12:35
Message:
Logged In: YES
user_id=309779
no, setting msg_queue to NULL isn't going to help (or if it
does, it's only by chance), because after swboard is
free'd/destroyed it should never be dereferenced.
Is this (lib)gaim 1.1.1 you're using, or some cvs snapshot?
----------------------------------------------------------------------
Comment By: Evan Schoenberg (evands)
Date: 2005-01-19 12:03
Message:
Logged In: YES
user_id=669684
I don't have a reliable way to reproduce, unfortunately... I think you're
right about a double-call to destroy. Would having the check against null
and actually setting msg_queue to NULL after destroying it be better?
----------------------------------------------------------------------
Comment By: Stu Tomlinson (nosnilmot)
Date: 2005-01-19 11:32
Message:
Logged In: YES
user_id=309779
Does this really prevent a crash? I don't think so:
a) g_queue_pop_head will return NULL if msg_queue is NULL,
b) nothing ever sets msg_queue to NULL
I suspect what's happening is msn_switchboard_destroy is
being called on a swboard that has already been destroyed /
free'd. Do you have a way to reproduce the crash this is
attempting to fix?
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=300235&aid=1104800&group_id=235
|
