summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVolker Lendecke <vl@samba.org>2013-01-31 16:34:41 +0100
committerJeremy Allison <jra@samba.org>2013-02-02 19:53:12 -0800
commit611fcca641a22a2a23b26752105af99cf338d6a1 (patch)
tree6162443763245abb9f17ae41da571e4e80ae0361
parent0cf62a92f26ef9c7d3c5a5d256adc72d66335319 (diff)
downloadsamba-611fcca641a22a2a23b26752105af99cf338d6a1.tar.gz
samba-611fcca641a22a2a23b26752105af99cf338d6a1.tar.bz2
samba-611fcca641a22a2a23b26752105af99cf338d6a1.zip
tevent_poll: Avoid a crash in poll_fresh_fde_destructor
The event context might have been freed before the fde Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
-rw-r--r--lib/tevent/tevent_poll.c11
1 files changed, 9 insertions, 2 deletions
diff --git a/lib/tevent/tevent_poll.c b/lib/tevent/tevent_poll.c
index 0c580e49ee..f63173744f 100644
--- a/lib/tevent/tevent_poll.c
+++ b/lib/tevent/tevent_poll.c
@@ -218,8 +218,15 @@ done:
static int poll_fresh_fde_destructor(struct tevent_fd *fde)
{
- struct poll_event_context *poll_ev = talloc_get_type_abort(
- fde->event_ctx->additional_data, struct poll_event_context);
+ struct tevent_context *ev = fde->event_ctx;
+ struct poll_event_context *poll_ev;
+
+ if (ev == NULL) {
+ return 0;
+ }
+ poll_ev = talloc_get_type_abort(
+ ev->additional_data, struct poll_event_context);
+
DLIST_REMOVE(poll_ev->fresh, fde);
return 0;
}