From 8b11d3c1627f1dc3c7966bb51901bcdcf1f8a9fb Mon Sep 17 00:00:00 2001 From: Pekka Riikonen Date: Thu, 10 Apr 2008 17:59:59 +0300 Subject: [PATCH] Fixed packet stream destroy crashes when closing connections. Take a reference of the packet stream and then destroy it. The final reference is freed in the timeout callback. Any operation in the mean time will detect the stream is destroyed and won't do anything. --- apps/silcd/server.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/apps/silcd/server.c b/apps/silcd/server.c index fd57d9d4..7d5ce4ed 100644 --- a/apps/silcd/server.c +++ b/apps/silcd/server.c @@ -269,6 +269,9 @@ static void silc_server_packet_error(SilcPacketEngine engine, SILC_CONNTYPE_STRING(idata->conn_type), silc_packet_error_string(error))); + if (!silc_packet_stream_is_valid(stream)) + return; + silc_schedule_task_add_timeout(server->schedule, silc_server_packet_error_timeout, stream, 0, 0); @@ -2845,7 +2848,7 @@ static void silc_server_rekey(SilcServer server, SilcPacketStream sock, SILC_TASK_CALLBACK(silc_server_close_connection_final) { - silc_packet_stream_destroy(context); + silc_packet_stream_unref(context); } /* Closes connection to socket connection */ @@ -2858,6 +2861,9 @@ void silc_server_close_connection(SilcServer server, const char *hostname; SilcUInt16 port; + if (!silc_packet_stream_is_valid(sock)) + return; + memset(tmp, 0, sizeof(tmp)); // silc_socket_get_error(sock, tmp, sizeof(tmp)); silc_socket_stream_get_info(silc_packet_stream_get_stream(sock), @@ -2873,6 +2879,11 @@ void silc_server_close_connection(SilcServer server, idata->sconn = NULL; } + /* Take a reference and then destroy the stream. The last reference + is released later in a timeout callback. */ + silc_packet_stream_ref(sock); + silc_packet_stream_destroy(sock); + /* Close connection with timeout */ server->stat.conn_num--; silc_schedule_task_del_by_all(server->schedule, 0, -- 2.24.0