diff options
author | Yorhel <git@yorhel.nl> | 2013-10-28 21:23:13 +0100 |
---|---|---|
committer | Yorhel <git@yorhel.nl> | 2013-10-28 21:23:13 +0100 |
commit | 81cbbdb1bd20f7823c916dccdac52680668213b7 (patch) | |
tree | ab863b9787ca5055d14d5186dafd10c9810389cc | |
parent | 80afb67567f6f2fb51b7f28bfb614aa9d861b932 (diff) |
dlfile.c: Fix another use-after-free in dlfile_recv_done()
I don't expect this to be a very problematic one.
-rw-r--r-- | src/dlfile.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/dlfile.c b/src/dlfile.c index 13c5a8c..f3c72b6 100644 --- a/src/dlfile.c +++ b/src/dlfile.c @@ -614,10 +614,11 @@ void dlfile_recv_done(dlfile_thread_t *t) { dl->active_threads--; t->busy = FALSE; + gboolean freet = FALSE; if(dl->islist ? dl->have == dl->size : !t->avail) { g_return_if_fail(!(t->err || t->uerr)); /* A failed thread can't be complete */ dl->threads = g_slist_remove(dl->threads, t); - g_slice_free(dlfile_thread_t, t); + freet = TRUE; } else { t->allocated = 0; dl->allbusy = FALSE; @@ -651,6 +652,8 @@ void dlfile_recv_done(dlfile_thread_t *t) { g_free(t->uerr_msg); t->err = t->uerr = 0; t->err_msg = t->uerr_msg = NULL; + if(freet) + g_slice_free(dlfile_thread_t, t); if(dorm) dl_queue_rm(dl); |