pidgin: d10d9099: Donot use a servconn if it's freed. Mark...

[sadrul at pidgin.im]

-----------------------------------------------------------------
Revision: d10d90993212a85a64ed238ed02232c132c2820f
Ancestor: 27e10a3b02f6740e4b3792615cc03925c5942ddd
Author: sadrul at pidgin.im
Date: 2009-10-08T18:14:41
Branch: im.pidgin.pidgin
URL: http://d.pidgin.im/viewmtn/revision/info/d10d90993212a85a64ed238ed02232c132c2820f

Modified files:
        libpurple/protocols/msn/notification.c
        libpurple/protocols/msn/servconn.c
        libpurple/protocols/msn/servconn.h

ChangeLog: 

Donot use a servconn if it's freed. Mark a leak.

-------------- next part --------------
============================================================
--- libpurple/protocols/msn/notification.c	6c6434bad656c2c8c94c6f6e60202f8bc476614d
+++ libpurple/protocols/msn/notification.c	57687ea2d593d48aea92ac2135f98bc4aac78c6e
@@ -582,7 +582,7 @@ msn_notification_send_fqy(MsnSession *se
 
 	trans = msn_transaction_new(cmdproc, "FQY", "%d", payload_len);
 	msn_transaction_set_payload(trans, payload, payload_len);
-	msn_transaction_set_data(trans, data);
+	msn_transaction_set_data(trans, data);	/* XXX: 'data' leaks */
 	msn_cmdproc_send_trans(cmdproc, trans);
 }
 
============================================================
--- libpurple/protocols/msn/servconn.c	477d9859f1e8937f49828a78a915d115f2a9cba4
+++ libpurple/protocols/msn/servconn.c	3af0658d2cedf5ddfd0410fb00a432bf41b0e5b9
@@ -440,11 +440,12 @@ read_cb(gpointer data, gint source, Purp
 	memcpy(servconn->rx_buf + servconn->rx_len, buf, len + 1);
 	servconn->rx_len += len;
 
-	msn_servconn_process_data(servconn);
-	servconn_timeout_renew(servconn);
+	servconn = msn_servconn_process_data(servconn);
+	if (servconn)
+		servconn_timeout_renew(servconn);
 }
 
-void msn_servconn_process_data(MsnServConn *servconn)
+MsnServConn *msn_servconn_process_data(MsnServConn *servconn)
 {
 	char *cur, *end, *old_rx_buf;
 	int cur_len;
@@ -503,10 +504,13 @@ void msn_servconn_process_data(MsnServCo
 
 	servconn->processing = FALSE;
 
-	if (servconn->wasted)
+	if (servconn->wasted) {
 		msn_servconn_destroy(servconn);
+		servconn = NULL;
+	}
 
 	g_free(old_rx_buf);
+	return servconn;
 }
 
 #if 0
============================================================
--- libpurple/protocols/msn/servconn.h	3f640a3dd26e50e1d9e822d00bd8740840f968c4
+++ libpurple/protocols/msn/servconn.h	f141547c3b7e96114d6dbfb6ec7b94b0f0901b2c
@@ -178,8 +178,10 @@ void msn_servconn_got_error(MsnServConn 
  * data from the socket.
  *
  * @param servconn The servconn.
+ *
+ * @return @c NULL if servconn was destroyed, 'servconn' otherwise.
  */
-void msn_servconn_process_data(MsnServConn *servconn);
+MsnServConn *msn_servconn_process_data(MsnServConn *servconn);
 
 /**
  * Set a idle timeout fot this servconn