Evas/cserve2: Fix crash during shutdown

If an image failed to load, and cserve2 returned an error message,
then the File_Entry was freed, but not removed from the hash.
Solution: remove entry from the hash, let the callback free the data.

1 files changed, 5 insertions, 10 deletions

diff --git a/src/lib/evas/cserve2/evas_cs2_client.c b/src/lib/evas/cserve2/evas_cs2_client.c
index c5ef5948a4..c65003f7d6 100644
--- a/src/lib/evas/cserve2/evas_cs2_client.c
+++ b/src/lib/evas/cserve2/evas_cs2_client.c
@@ -690,8 +690,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
      }
    ie->open_rid = 0;
 
-   if (answer->type != CSERVE2_OPENED)
+   if ((answer->type != CSERVE2_OPENED) || (size < (int) sizeof(*msg)))
      {
+        File_Entry *fentry = ie->data1;
         if (answer->type == CSERVE2_ERROR)
           {
              const Msg_Error *msg_error = msg_received;
@@ -700,15 +701,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
           }
         else
           ERR("Invalid message type received: %d (%s)", answer->type, __FUNCTION__);
-        free(ie->data1);
-        ie->data1 = NULL;
-        return EINA_TRUE;
-     }
-   else if (size < (int) sizeof(*msg))
-     {
-        ERR("Received message is too small");
-        free(ie->data1);
-        ie->data1 = NULL;
+        fentry = ie->data1;
+        EINA_REFCOUNT_UNREF(fentry)
+          eina_hash_del(_file_entries, fentry->hkey, fentry);
         return EINA_TRUE;
      }