[GNUnet-SVN] r31055 - gnunet/src/mesh

[gnunet]

Author: bartpolot
Date: 2013-12-05 03:13:36 +0100 (Thu, 05 Dec 2013)
New Revision: 31055

Modified:
   gnunet/src/mesh/gnunet-service-mesh_channel.c
Log:
- avoid dereferencing copy after channel (and therefore copy) was destroyed


Modified: gnunet/src/mesh/gnunet-service-mesh_channel.c
===================================================================
--- gnunet/src/mesh/gnunet-service-mesh_channel.c       2013-12-05 01:42:20 UTC 
(rev 31054)
+++ gnunet/src/mesh/gnunet-service-mesh_channel.c       2013-12-05 02:13:36 UTC 
(rev 31055)
@@ -922,7 +922,7 @@
   {
     GNUNET_SCHEDULER_cancel (rel->retry_task);
   }
-  if (NULL != rel->uniq)
+  if (NULL != rel->uniq && NULL != rel->uniq->q)
     GMT_cancel (rel->uniq->q);
   GNUNET_free (rel);
 }
@@ -1041,19 +1041,21 @@
     LOG (GNUNET_ERROR_TYPE_DEBUG, "!!! batch free, ignoring timing\n");
   }
   rel->ch->pending_messages--;
-  if (GNUNET_NO != rel->ch->destroy && 0 == rel->ch->pending_messages)
-  {
-    struct MeshTunnel3 *t = rel->ch->t;
-    GMCH_destroy (rel->ch);
-    GMT_destroy_if_empty (t);
-  }
   if (NULL != copy->q)
   {
     GMT_cancel (copy->q->q);
+    /* copy->q is set to NULL by ch_message_sent */
   }
   GNUNET_CONTAINER_DLL_remove (rel->head_sent, rel->tail_sent, copy);
   LOG (GNUNET_ERROR_TYPE_DEBUG, " COPYFREE %p\n", copy);
   GNUNET_free (copy);
+
+  if (GNUNET_NO != rel->ch->destroy && 0 == rel->ch->pending_messages)
+  {
+    struct MeshTunnel3 *t = rel->ch->t;
+    GMCH_destroy (rel->ch);
+    GMT_destroy_if_empty (t);
+  }
 }