diff options
author | Denis Kenzior <denkenz@gmail.com> | 2009-10-16 16:25:19 -0500 |
---|---|---|
committer | Denis Kenzior <denkenz@gmail.com> | 2009-10-16 17:46:28 -0500 |
commit | feda620c94a9e3c0951ddc74994e5c6f2f22ee07 (patch) | |
tree | e30b2282ba01d798c376d607eb6a95901a2af7c2 | |
parent | 41c4abada001ded03600476e592eb03a4745f2cd (diff) | |
download | ofono-feda620c94a9e3c0951ddc74994e5c6f2f22ee07.tar.bz2 |
Fix: Stop crashing when unrefing chat in callback
-rw-r--r-- | gatchat/gatchat.c | 23 |
1 files changed, 20 insertions, 3 deletions
diff --git a/gatchat/gatchat.c b/gatchat/gatchat.c index e5b6ed7a..320150af 100644 --- a/gatchat/gatchat.c +++ b/gatchat/gatchat.c @@ -87,6 +87,7 @@ struct _GAtChat { guint wakeup_timeout; /* How long to wait for resp */ GTimer *wakeup_timer; /* Keep track of elapsed time */ GAtSyntax *syntax; + gboolean destroyed; /* Re-entrancy guard */ }; static gint at_notify_node_compare_by_id(gconstpointer a, gconstpointer b) @@ -259,6 +260,9 @@ static void read_watcher_destroy_notify(GAtChat *chat) if (chat->user_disconnect) chat->user_disconnect(chat->user_disconnect_data); + + if (chat->destroyed) + g_free(chat); } static void write_watcher_destroy_notify(GAtChat *chat) @@ -587,7 +591,9 @@ static void new_bytes(GAtChat *p) GAtSyntaxResult result; - while (p->read_so_far < len) { + g_at_chat_ref(p); + + while (p->channel && (p->read_so_far < len)) { gsize rbytes = MIN(len - p->read_so_far, wrap - p->read_so_far); result = p->syntax->feed(p->syntax, (char *)buf, &rbytes); @@ -628,8 +634,10 @@ static void new_bytes(GAtChat *p) } /* We're overflowing the buffer, shutdown the socket */ - if (ring_buffer_avail(p->buf) == 0) + if (p->buf && ring_buffer_avail(p->buf) == 0) g_source_remove(p->read_watch); + + g_at_chat_unref(p); } static void debug_chat(GAtChat *chat, gboolean in, const char *str, gsize len) @@ -990,7 +998,16 @@ void g_at_chat_unref(GAtChat *chat) return; g_at_chat_shutdown(chat); - g_free(chat); + + /* glib delays the destruction of the watcher until it exits, this + * means we can't free the data just yet, even though we've been + * destroyed already. We have to wait until the read_watcher + * destroy function gets called + */ + if (chat->read_watch != 0) + chat->destroyed = TRUE; + else + g_free(chat); } gboolean g_at_chat_shutdown(GAtChat *chat) |