this is a bug.

[x hl]

I'm hailong from china beijing...
I'm working on httptunnel system...
I'm modifying it for deal wiht multi-user connection.

I find out a re-free bug, as follows:

static int
tunnel_in_connect (Tunnel *tunnel)
{
 Http_response *response;
 ssize_t n;

 log_verbose ("tunnel_in_connect()");

 if (tunnel->in_fd != -1)
   {
     log_error ("tunnel_in_connect: already connected");
     return -1;
   }

 tunnel->in_fd = do_connect (&tunnel->address);
 if (tunnel->in_fd == -1)
   {
     log_error ("tunnel_in_connect: do_connect() error: %s",
                strerror (errno));
     return -1;
   }

 tunnel_in_setsockopts (tunnel->in_fd);

 if (http_get (tunnel->in_fd, &tunnel->dest) == -1)
   return -1;

#ifdef USE_SHUTDOWN
 if (shutdown (tunnel->in_fd, 1) == -1)
   {
     log_error ("tunnel_in_connect: shutdown() error: %s",
                strerror (errno));
     return -1;
   }
#endif

 n = http_parse_response (tunnel->in_fd, &response);
 /// here, when n <= 0, you should return, otherwase, 
 /// will appear re-free error at follow fountion 'http_destroy_response'.
 if (n <= 0)
   {
     if (n == 0)
       log_error ("tunnel_in_connect: no response; peer "
                  "closed connection");
     else
       log_error ("tunnel_in_connect: no response; error: %s",
                  strerror (errno));
   }
 else if (response->major_version != 1 ||
          (response->minor_version != 1 &&
           response->minor_version != 0))
   {
     log_error ("tunnel_in_connect: unknown HTTP version: %d.%d",
                response->major_version, response->minor_version);
     n = -1;
   }
 else if (response->status_code != 200)
   {
     log_error ("tunnel_in_connect: HTTP error %d", 
response->status_code);
     errno = http_error_to_errno (-response->status_code);
     n = -1;
   }

 //// here, lurk a re-free problem, because there are some case 
 //// to free 'response' in http_parse_response function.
 http_destroy_response (response);

 if (n > 0)
   {
#ifdef IO_COUNT_HTTP_HEADER
     tunnel->in_total_raw += n;
     log_annoying ("tunnel_in_connect: in_total_raw = %u",
                   tunnel->in_total_raw);
#endif
   }
 else
   {
     return n;
   }

 log_debug ("tunnel_in_connect: input connected");
 return 1;
}

_________________________________________________________________
享用世界上最大的电子邮件系统― MSN Hotmail。  http://www.hotmail.com