From b10dcb5c2366c135bbae014d084b07f039b34fde Mon Sep 17 00:00:00 2001 From: Jean-Philippe Andre Date: Mon, 9 Dec 2013 17:48:32 +0900 Subject: [PATCH] Evas/cserve2: Fix crash during shutdown If an image failed to load, and cserve2 returned an error message, then the File_Entry was freed, but not removed from the hash. Solution: remove entry from the hash, let the callback free the data. --- src/lib/evas/cserve2/evas_cs2_client.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/src/lib/evas/cserve2/evas_cs2_client.c b/src/lib/evas/cserve2/evas_cs2_client.c index c5ef5948a4..c65003f7d6 100644 --- a/src/lib/evas/cserve2/evas_cs2_client.c +++ b/src/lib/evas/cserve2/evas_cs2_client.c @@ -690,8 +690,9 @@ _image_opened_cb(void *data, const void *msg_received, int size) } ie->open_rid = 0; - if (answer->type != CSERVE2_OPENED) + if ((answer->type != CSERVE2_OPENED) || (size < (int) sizeof(*msg))) { + File_Entry *fentry = ie->data1; if (answer->type == CSERVE2_ERROR) { const Msg_Error *msg_error = msg_received; @@ -700,15 +701,9 @@ _image_opened_cb(void *data, const void *msg_received, int size) } else ERR("Invalid message type received: %d (%s)", answer->type, __FUNCTION__); - free(ie->data1); - ie->data1 = NULL; - return EINA_TRUE; - } - else if (size < (int) sizeof(*msg)) - { - ERR("Received message is too small"); - free(ie->data1); - ie->data1 = NULL; + fentry = ie->data1; + EINA_REFCOUNT_UNREF(fentry) + eina_hash_del(_file_entries, fentry->hkey, fentry); return EINA_TRUE; }