Re: git-http-fetch segfault, curl 7.18.0
- From
Mike Hommey <mh@glandium.org>
- Date
- Mar 2, 2008, 20:33 UTC
- Message-ID
- <20080302203344.GA8760@glandium.org>
- In-Reply-To
- <alpine.LNX.1.00.0803021508340.19665@iabervon.org>
On Sun, Mar 02, 2008 at 03:20:17PM -0500, Daniel Barkalow wrote:
Show 10 quoted lines
> > And the problem lies in the fact we run_active_slot() during cleanup, > > which can end up going through all the slots starting at > > active_queue_head, while we have freed the first slots... > > > > Now, why do we need to run slots when cleaning up ? > > AFAICT, it's always been that way. I assume there was code that set up all > of the remaining transfers and then just called http_cleanup, relying on > the callbacks to handle the receipt of the remaining data, but I'm not > sure if that's still the case.
It doesn't look like it is stil the case.
Show 8 quoted lines
> On the other hand, I think that code is > supposed to remove slots from the active queue as they get processed, so > that run_active_slot() is always safe to call and just won't do anything > if it's not needed in cleanup. > > So I'm guessing that we have list corruption due to code getting careless > in error cases, in addition to cleanup code that possibly cares too much > about finishing everything it can.
That's in fill_active_slots that it's trying to go through all slots starting at active_queue_head, which is likely to be freed at this point. The fix I sent earlier just throws all active slots, which should just be fine now.
Mike