summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorYorhel <git@yorhel.nl>2013-10-28 21:23:13 +0100
committerYorhel <git@yorhel.nl>2013-10-28 21:23:13 +0100
commit81cbbdb1bd20f7823c916dccdac52680668213b7 (patch)
treeab863b9787ca5055d14d5186dafd10c9810389cc
parent80afb67567f6f2fb51b7f28bfb614aa9d861b932 (diff)
dlfile.c: Fix another use-after-free in dlfile_recv_done()
I don't expect this to be a very problematic one.
-rw-r--r--src/dlfile.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/src/dlfile.c b/src/dlfile.c
index 13c5a8c..f3c72b6 100644
--- a/src/dlfile.c
+++ b/src/dlfile.c
@@ -614,10 +614,11 @@ void dlfile_recv_done(dlfile_thread_t *t) {
dl->active_threads--;
t->busy = FALSE;
+ gboolean freet = FALSE;
if(dl->islist ? dl->have == dl->size : !t->avail) {
g_return_if_fail(!(t->err || t->uerr)); /* A failed thread can't be complete */
dl->threads = g_slist_remove(dl->threads, t);
- g_slice_free(dlfile_thread_t, t);
+ freet = TRUE;
} else {
t->allocated = 0;
dl->allbusy = FALSE;
@@ -651,6 +652,8 @@ void dlfile_recv_done(dlfile_thread_t *t) {
g_free(t->uerr_msg);
t->err = t->uerr = 0;
t->err_msg = t->uerr_msg = NULL;
+ if(freet)
+ g_slice_free(dlfile_thread_t, t);
if(dorm)
dl_queue_rm(dl);