Commit 1abd526c authored by Nick Mathewson's avatar Nick Mathewson 🦀
Browse files

Merge remote-tracking branch 'public/bug12985_025'

parents 7dd85283 139a1c64

changes/bug12985

0 → 100644
+5 −0
Original line number Diff line number Diff line 
  o Minor bugfixes (shutdown):

    - When shutting down, always call event_del() on lingering read or

      write events before freeing them. Otherwise, we risk double-frees

      or read-after-frees in event_base_free(). Fixes bug 12985; bugfix on

      0.1.0.2-rc.

src/common/compat_libevent.c

+13 −1
Original line number Diff line number Diff line
@@ -146,13 +146,25 @@ tor_evsignal_new(struct event_base * base, int sig, 
{

  return tor_event_new(base, sig, EV_SIGNAL|EV_PERSIST, cb, arg);

}

/** Work-alike replacement for event_free() on pre-Libevent-2.0 systems. */

/** Work-alike replacement for event_free() on pre-Libevent-2.0 systems,

 * except tolerate tor_event_free(NULL). */

void

tor_event_free(struct event *ev)

{

  if (ev == NULL)

    return;

  event_del(ev);

  tor_free(ev);

}

#else

/* Wrapper for event_free() that tolerates tor_event_free(NULL) */

void

tor_event_free(struct event *ev)

{

  if (ev == NULL)

    return;

  event_free(ev);

}

#endif



/** Global event base for use by the main thread. */

src/common/compat_libevent.h

+2 −3
Original line number Diff line number Diff line
@@ -28,11 +28,9 @@ void suppress_libevent_log_msg(const char *msg); 
#define tor_event_new     event_new

#define tor_evtimer_new   evtimer_new

#define tor_evsignal_new  evsignal_new

#define tor_event_free    event_free

#define tor_evdns_add_server_port(sock, tcp, cb, data) \

  evdns_add_server_port_with_base(tor_libevent_get_base(), \

  (sock),(tcp),(cb),(data));



#else

struct event *tor_event_new(struct event_base * base, evutil_socket_t sock,

           short what, void (*cb)(evutil_socket_t, short, void *), void *arg);
@@ -40,10 +38,11 @@ struct event *tor_evtimer_new(struct event_base * base, 
            void (*cb)(evutil_socket_t, short, void *), void *arg);

struct event *tor_evsignal_new(struct event_base * base, int sig,

            void (*cb)(evutil_socket_t, short, void *), void *arg);

void tor_event_free(struct event *ev);

#define tor_evdns_add_server_port evdns_add_server_port

#endif



void tor_event_free(struct event *ev);



typedef struct periodic_timer_t periodic_timer_t;



periodic_timer_t *periodic_timer_new(struct event_base *base,

src/or/connection.c

+4 −2
Original line number Diff line number Diff line
@@ -574,8 +574,10 @@ connection_free_(connection_t *conn) 
    tor_free(control_conn->incoming_cmd);

  }



  tor_free(conn->read_event); /* Probably already freed by connection_free. */

  tor_free(conn->write_event); /* Probably already freed by connection_free. */

  /* Probably already freed by connection_free. */

  tor_event_free(conn->read_event);

  tor_event_free(conn->write_event);

  conn->read_event = conn->write_event = NULL;

  IF_HAS_BUFFEREVENT(conn, {

      /* This was a workaround to handle bugs in some old versions of libevent

       * where callbacks can occur after calling bufferevent_free().  Setting