Re: [libusb] Cancel Transfer Within Callback?

[Chris D. <chr...@gm...>]

Hi Jeffrey,

On Wed, Sep 2, 2015 at 9:02 AM, Jeffrey Nichols <jsn...@su...>
wrote:
>
> It seems like that's the source of my problems and I'll have to reorganize
> my code to be more sensible.
>

OK, this is most certainly the cause of the issue then. The first call to
libusb_handle_events() will be iterating over a list of dynamically
allocated pollfds in the backend (one for each transfer). When
libusb_handle_events() gets called within the transfer callback, it will
see that the pollfds have been modified because a transfer has just
completed, so it will free the original pollfd list and allocate a new one.
Once the stack is popped back to the original libusb_handle_events() call,
it will now be iterating over freed memory.

It's a good catch, something that should be documented as unsupported and
guarded against within the code.

Regards,
Chris