r9464: fixed a problem with child pointers copied into non-allocated mpr variables. We

now use the same free technique as is used for mpr strings, rather than relying on
being a child of the variable
(This used to be commit 3d6739eaa6e1b56d67bc7d9b5350a6911c96597a)

2 files changed, 17 insertions, 3 deletions

diff --git a/source4/lib/appweb/mpr/var.c b/source4/lib/appweb/mpr/var.c
index 77f4cbc55a..09979156e8 100644
--- a/source4/lib/appweb/mpr/var.c
+++ b/source4/lib/appweb/mpr/var.c
@@ -181,6 +181,13 @@ static bool freeVarStorage(MprVar *vp, int force)
 		}
 		break;
 
+	case MPR_TYPE_PTR:
+		if (vp->allocatedData) {
+			vp->allocatedData = 0;
+			mprFree(vp->ptr);
+		}
+		break;
+
 	case MPR_TYPE_OBJECT:
 #if VAR_DEBUG
 		/*
@@ -1418,7 +1425,12 @@ static void copyVarCore(MprVar *dest, MprVar *src, int copyDepth)
 	case MPR_TYPE_PTR:
 		/* we have to reference here so talloc structures survive a
 		   copy */
-		dest->ptr = talloc_reference(dest, src->ptr);
+		if (src->allocatedData) {
+			dest->ptr = talloc_reference(mprMemCtx(), src->ptr);
+			dest->allocatedData = 1;
+		} else {
+			dest->ptr = src->ptr;
+		}
 		break;
 
 	case MPR_TYPE_STRING_CFUNCTION:
diff --git a/source4/scripting/ejs/mprutil.c b/source4/scripting/ejs/mprutil.c
index 8f1e5f71c8..38cfd2c493 100644
--- a/source4/scripting/ejs/mprutil.c
+++ b/source4/scripting/ejs/mprutil.c
@@ -369,12 +369,14 @@ void mprSetPtr(struct MprVar *v, const char *propname, const void *p)
 }
 
 /*
-  set a pointer in a existing MprVar, making it a child of the property
+  set a pointer in a existing MprVar, freeing it when the property goes away
 */
 void mprSetPtrChild(struct MprVar *v, const char *propname, const void *p)
 {
 	mprSetVar(v, propname, mprCreatePtrVar(discard_const(p)));
-	talloc_steal(mprGetProperty(v, propname, NULL), p);
+	v = mprGetProperty(v, propname, NULL);
+	v->allocatedData = 1;
+	talloc_steal(mprMemCtx(), p);
 }
 
 /*