pidgin: dadb590a: Fix two related on-disconnect double fre...

[darkrain42 at pidgin.im]

-----------------------------------------------------------------
Revision: dadb590a21abe478365502368b3f5e7598334a1a
Ancestor: 5596fda5b3d5323e89b01f2a273b71eb74156b46
Author: darkrain42 at pidgin.im
Date: 2010-03-28T18:08:38
Branch: im.pidgin.pidgin
URL: http://d.pidgin.im/viewmtn/revision/info/dadb590a21abe478365502368b3f5e7598334a1a

Modified files:
        libpurple/protocols/bonjour/jabber.c
        libpurple/protocols/qq/qq.c

ChangeLog: 

Fix two related on-disconnect double frees.

_purple_connection_destroy calls purple_proxy_connect_cancel_with_handle(gc),
and both of these plugins use gc as the handle for their connection attempts.
Their respective close() functions /also/ try to cancel the connection
attempts, which leads to a double-free.

One of these was reported by mati, the other by T_X.

-------------- next part --------------
============================================================
--- libpurple/protocols/bonjour/jabber.c	6f0c25d0cf3e373490257a95d6e7e3265b810eff
+++ libpurple/protocols/bonjour/jabber.c	4ac3c6f9e04ad9fb51f9383cb35501c9035fdfb4
@@ -1185,6 +1185,9 @@ bonjour_jabber_stop(BonjourJabber *jdata
 		for (l = buddies; l; l = l->next) {
 			BonjourBuddy *bb = purple_buddy_get_protocol_data((PurpleBuddy*) l->data);
 			if (bb != NULL) {
+				/* Any ongoing connection attempt is cancelled
+				 * by _purple_connection_destroy */
+				bb->conversation->connect_data = NULL;
 				bonjour_jabber_close_conversation(bb->conversation);
 				bb->conversation = NULL;
 			}
============================================================
--- libpurple/protocols/qq/qq.c	3f3a716b6adbc52cfba50bf8828d67c3cc79de6f
+++ libpurple/protocols/qq/qq.c	14ed198169b87cd92e135dd0e7750119016152b9
@@ -221,6 +221,9 @@ static void qq_close(PurpleConnection *g
 		qd->connect_watcher = 0;
 	}
 
+	/* This is cancelled by _purple_connection_destroy */
+	qd->conn_data = NULL;
+
 	qq_disconnect(gc);
 
 	if (qd->redirect) g_free(qd->redirect);