bugGNUstep - Bugs: bug #25915, Segfault in -[NSNotificationQueue...

Group
 
 

bug #25915: Segfault in -[NSNotificationQueue dealloc]

Submitter:  Larry Campbell <lcampbel>
Submitted:  Wed 18 Mar 2009 02:56:06 PM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 18 Mar 2009 03:48:57 PM UTC, comment #1: 

Thanks, I simplified/fixed the code in svn.

Richard Frith-Macdonald <CaS>
Group Member
Wed 18 Mar 2009 02:56:06 PM UTC, original submission:  

-[NSNotificationQueue dealloc] traverses a linked list of NSNotificationQueueRegistration objects, deleting each object from the queue, but makes the classic mistake of dereferencing the link to the next object after the object has been freed.

Here's the fix:

--- NSNotificationQueue.m.orig 2008-06-09 00:05:01.000000000 -0400
+++ NSNotificationQueue.m 2009-03-18 10:51:55.000000000 -0400
@@ -353,6 +353,7 @@
 - (void) dealloc
 {
   NSNotificationQueueRegistration *item;
+  NSNotificationQueueRegistration       *prev;
 
   /*
    * remove from class instances list
@@ -362,14 +363,16 @@
   /*
    * release self from queues
    */
-  for (item = _asapQueue->head; item; item=item->prev)
+  for (item = _asapQueue->head; item; item=prev)
     {
+      prev = item->prev;
       remove_from_queue(_asapQueue, item, _zone);
     }
   NSZoneFree(_zone, _asapQueue);
 
-  for (item = _idleQueue->head; item; item=item->prev)
+  for (item = _idleQueue->head; item; item=prev)
     {
+      prev = item->prev;
       remove_from_queue(_idleQueue, item, _zone);
     }
   NSZoneFree(_zone, _idleQueue);


Larry Campbell <lcampbel>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by lcampbel (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-03-18 CaS StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code