evin/ms-nfs41-client
3
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

tirpc: memory corruption in clnt_vc_destroy()

Browse source 
stop the callback thread before freeing any memory!

Signed-off-by: Casey Bodley <cbodley@citi.umich.edu>
This commit is contained in:
Casey Bodley 2010-11-08 11:17:25 -05:00
parent 50dbd847f0
commit 575200952a
1 changed files with 14 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

27
libtirpc/src/clnt_vc.c
View file

@ -848,17 +848,6 @@ clnt_vc_destroy(cl)
mutex_lock(&clnt_fd_lock); mutex_lock(&clnt_fd_lock);
while (vc_fd_locks[WINSOCK_HANDLE_HASH(ct_fd)]) while (vc_fd_locks[WINSOCK_HANDLE_HASH(ct_fd)])
cond_wait(&vc_cv[WINSOCK_HANDLE_HASH(ct_fd)], &clnt_fd_lock); cond_wait(&vc_cv[WINSOCK_HANDLE_HASH(ct_fd)], &clnt_fd_lock);
if (ct->ct_closeit && ct->ct_fd != -1) {
(void)closesocket(ct->ct_fd);
}
XDR_DESTROY(&(ct->ct_xdrs));
if (ct->ct_addr.buf)
free(ct->ct_addr.buf);
mem_free(ct, sizeof(struct ct_data));
if (cl->cl_netid && cl->cl_netid[0])
mem_free(cl->cl_netid, strlen(cl->cl_netid) +1);
if (cl->cl_tp && cl->cl_tp[0])
mem_free(cl->cl_tp, strlen(cl->cl_tp) +1);
if (cl->cb_thread != INVALID_HANDLE_VALUE) { if (cl->cb_thread != INVALID_HANDLE_VALUE) {
int status; int status;
@ -870,9 +859,21 @@ clnt_vc_destroy(cl)
status = WaitForSingleObject(cl->cb_thread, INFINITE); status = WaitForSingleObject(cl->cb_thread, INFINITE);
fprintf(stdout, "%04x: terminated callback thread\n", GetCurrentThreadId()); fprintf(stdout, "%04x: terminated callback thread\n", GetCurrentThreadId());
mutex_lock(&clnt_fd_lock); mutex_lock(&clnt_fd_lock);
while (vc_fd_locks[WINSOCK_HANDLE_HASH(ct_fd)]) while (vc_fd_locks[WINSOCK_HANDLE_HASH(ct_fd)])
cond_wait(&vc_cv[WINSOCK_HANDLE_HASH(ct_fd)], &clnt_fd_lock); cond_wait(&vc_cv[WINSOCK_HANDLE_HASH(ct_fd)], &clnt_fd_lock);
} }
if (ct->ct_closeit && ct->ct_fd != -1) {
(void)closesocket(ct->ct_fd);
}
XDR_DESTROY(&(ct->ct_xdrs));
if (ct->ct_addr.buf)
free(ct->ct_addr.buf);
mem_free(ct, sizeof(struct ct_data));
if (cl->cl_netid && cl->cl_netid[0])
mem_free(cl->cl_netid, strlen(cl->cl_netid) +1);
if (cl->cl_tp && cl->cl_tp[0])
mem_free(cl->cl_tp, strlen(cl->cl_tp) +1);
mem_free(cl, sizeof(CLIENT)); mem_free(cl, sizeof(CLIENT));
mutex_unlock(&clnt_fd_lock); mutex_unlock(&clnt_fd_lock);
// thr_sigsetmask(SIG_SETMASK, &(mask), NULL); // thr_sigsetmask(SIG_SETMASK, &(mask), NULL);