From: 윤정현 <jh0506.yun@samsung.com>
Subject: Re: [E-devel] [Patch] ecore_ipc - remove potential risk in ecore_ipc_shutdown I found a problem this infinite loop case. If server is deleted, then ECORE_IPC_EVENT_SERVER_DEL callback function will be called in client side. It will happen infinite loop in ecore_ipc_shutdown if ecore_ipc_shutdown called in this ECORE_IPC_EVENT_SERVER_DEL callback function. For example, server_del_handler = ecore_event_handler_add(ECORE_IPC_EVENT_SERVER_DEL, _server_del_cb, NULL); static Eina_Bool _server_del_cb(void *data, int type, void *event) { ecore_ipc_shutdown(); return EINA_TRUE; } If server is deleted, 1. _ecore_ipc_event_server_del : svr->event_count++ 2. _server_del_cb : ecore_ipc_shutdown called 3. ecore_ipc_shutdown : while (servers) ecore_ipc_server_del(eina_list_data_get(servers)) 4. ecore_ipc_server_del : can't eina_list_remove(servers, svr) because event_count != 0 5. infinite loop I think this while code is very dangerous whether user miss or not. I modified EINA_LIST_FOREACH_SAFE instead of EINA_LIST_FOREACH refer to ecore_con. Please review this patch. SVN revision: 67874
This commit is contained in:
parent
f7ac08317c
commit
b297da56de
|
@ -316,7 +316,10 @@ ecore_ipc_shutdown(void)
|
|||
if (--_ecore_ipc_init_count != 0)
|
||||
return _ecore_ipc_init_count;
|
||||
|
||||
while (servers) ecore_ipc_server_del(eina_list_data_get(servers));
|
||||
Eina_List *l, *l2;
|
||||
Ecore_Ipc_Server *svr;
|
||||
EINA_LIST_FOREACH_SAFE(servers, l, l2, svr)
|
||||
ecore_ipc_server_del(svr);
|
||||
|
||||
for (i = 0; i < 6; i++)
|
||||
ecore_event_handler_del(handler[i]);
|
||||
|
|
Loading…
Reference in New Issue