summaryrefslogtreecommitdiff
path: root/src/lib/evas/cserve2/evas_cs2_client.c
diff options
context:
space:
mode:
authorJean-Philippe Andre <jp.andre@samsung.com>2013-12-09 17:48:32 +0900
committerJean-Philippe Andre <jp.andre@samsung.com>2013-12-09 17:48:32 +0900
commitb10dcb5c2366c135bbae014d084b07f039b34fde (patch)
tree0eb6294e076ea08dd4b1e4d5ba6b58c50ec7752a /src/lib/evas/cserve2/evas_cs2_client.c
parentce166ec2232f7628fe5f57603b58c4e620c60567 (diff)
Evas/cserve2: Fix crash during shutdown
If an image failed to load, and cserve2 returned an error message, then the File_Entry was freed, but not removed from the hash. Solution: remove entry from the hash, let the callback free the data.
Diffstat (limited to 'src/lib/evas/cserve2/evas_cs2_client.c')
-rw-r--r--src/lib/evas/cserve2/evas_cs2_client.c15
1 files changed, 5 insertions, 10 deletions
diff --git a/src/lib/evas/cserve2/evas_cs2_client.c b/src/lib/evas/cserve2/evas_cs2_client.c
index c5ef5948a4..c65003f7d6 100644
--- a/src/lib/evas/cserve2/evas_cs2_client.c
+++ b/src/lib/evas/cserve2/evas_cs2_client.c
@@ -690,8 +690,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
690 } 690 }
691 ie->open_rid = 0; 691 ie->open_rid = 0;
692 692
693 if (answer->type != CSERVE2_OPENED) 693 if ((answer->type != CSERVE2_OPENED) || (size < (int) sizeof(*msg)))
694 { 694 {
695 File_Entry *fentry = ie->data1;
695 if (answer->type == CSERVE2_ERROR) 696 if (answer->type == CSERVE2_ERROR)
696 { 697 {
697 const Msg_Error *msg_error = msg_received; 698 const Msg_Error *msg_error = msg_received;
@@ -700,15 +701,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
700 } 701 }
701 else 702 else
702 ERR("Invalid message type received: %d (%s)", answer->type, __FUNCTION__); 703 ERR("Invalid message type received: %d (%s)", answer->type, __FUNCTION__);
703 free(ie->data1); 704 fentry = ie->data1;
704 ie->data1 = NULL; 705 EINA_REFCOUNT_UNREF(fentry)
705 return EINA_TRUE; 706 eina_hash_del(_file_entries, fentry->hkey, fentry);
706 }
707 else if (size < (int) sizeof(*msg))
708 {
709 ERR("Received message is too small");
710 free(ie->data1);
711 ie->data1 = NULL;
712 return EINA_TRUE; 707 return EINA_TRUE;
713 } 708 }
714 709