Fixed packet stream destroy crashes when closing connections.

Take a reference of the packet stream and then destroy it.  The final
reference is freed in the timeout callback.  Any operation in the mean
time will detect the stream is destroyed and won't do anything.

diff --git a/apps/silcd/server.c b/apps/silcd/server.c
index fd57d9d410cb2773f1b346222169454b220e7998..7d5ce4edb2a1fd4c925d638aa73ea537b3513066 100644 (file)
--- a/apps/silcd/server.c
+++ b/apps/silcd/server.c
@@ -269,6 +269,9 @@ static void silc_server_packet_error(SilcPacketEngine engine,
                  SILC_CONNTYPE_STRING(idata->conn_type),
                  silc_packet_error_string(error)));
 
+  if (!silc_packet_stream_is_valid(stream))
+    return;
+
   silc_schedule_task_add_timeout(server->schedule,
                                 silc_server_packet_error_timeout,
                                 stream, 0, 0);
@@ -2845,7 +2848,7 @@ static void silc_server_rekey(SilcServer server, SilcPacketStream sock,
 
 SILC_TASK_CALLBACK(silc_server_close_connection_final)
 {
-  silc_packet_stream_destroy(context);
+  silc_packet_stream_unref(context);
 }
 
 /* Closes connection to socket connection */
@@ -2858,6 +2861,9 @@ void silc_server_close_connection(SilcServer server,
   const char *hostname;
   SilcUInt16 port;
 
+  if (!silc_packet_stream_is_valid(sock))
+    return;
+
   memset(tmp, 0, sizeof(tmp));
   //  silc_socket_get_error(sock, tmp, sizeof(tmp));
   silc_socket_stream_get_info(silc_packet_stream_get_stream(sock),
@@ -2873,6 +2879,11 @@ void silc_server_close_connection(SilcServer server,
     idata->sconn = NULL;
   }
 
+  /* Take a reference and then destroy the stream.  The last reference
+     is released later in a timeout callback. */
+  silc_packet_stream_ref(sock);
+  silc_packet_stream_destroy(sock);
+
   /* Close connection with timeout */
   server->stat.conn_num--;
   silc_schedule_task_del_by_all(server->schedule, 0,