lobo/isync
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

don't access free'd memory in cancel_sync()

Browse Source 
as it happens, the 1st round *may* trash svars - if we get the
cancelation request after the slave store has already died.
This commit is contained in:
Oswald Buddenhagen 2012-07-22 17:46:54 +02:00
parent 9554026443
commit 6d86e5347e
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/sync.c
View File

@ -403,14 +403,17 @@ cancel_sync( sync_vars_t *svars )
{ {
int t; int t;
/* the 1st round is guaranteed not to trash svars */ for (t = 0; t < 2; t++) {
for (t = 0; t < 2; t++) int other_state = svars->state[1-t];
if (svars->ret & SYNC_BAD(t)) { if (svars->ret & SYNC_BAD(t)) {
svars->drv[t]->cancel_store( svars->ctx[t] ); svars->drv[t]->cancel_store( svars->ctx[t] );
cancel_done( AUX ); cancel_done( AUX );
} else { } else {
svars->drv[t]->cancel( svars->ctx[t], cancel_done, AUX ); svars->drv[t]->cancel( svars->ctx[t], cancel_done, AUX );
} }
if (other_state & ST_CANCELED)
break;
}
} }
static void static void