Browse code

dmq: fixed crash caused by freeing pointer too early on tm callback

Charles Chance authored on 14/02/2014 10:21:00
Showing 1 changed files
... ...
@@ -228,8 +228,12 @@ dmq_node_t* find_dmq_node_uri(dmq_node_list_t* list, str* uri)
228 228
 void destroy_dmq_node(dmq_node_t* node, int shm)
229 229
 {
230 230
 	if(shm) {
231
+		if (node->params!=NULL)
232
+			shm_free_params(node->params);
231 233
 		shm_free_node(node);
232 234
 	} else {
235
+		if (node->params!=NULL)
236
+			free_params(node->params);
233 237
 		pkg_free_node(node);
234 238
 	}
235 239
 }
... ...
@@ -283,8 +287,6 @@ void shm_free_node(dmq_node_t* node)
283 287
 {
284 288
 	if (node->orig_uri.s!=NULL) 
285 289
 		shm_free(node->orig_uri.s);
286
-	if (node->params!=NULL) 
287
-		shm_free_params(node->params);
288 290
 	shm_free(node);
289 291
 }
290 292
 
... ...
@@ -295,8 +297,6 @@ void pkg_free_node(dmq_node_t* node)
295 297
 {
296 298
 	if (node->orig_uri.s!=NULL) 
297 299
 		pkg_free(node->orig_uri.s);
298
-        if (node->params!=NULL)
299
-                free_params(node->params);
300 300
 	pkg_free(node);
301 301
 }
302 302
 
... ...
@@ -312,7 +312,7 @@ int del_dmq_node(dmq_node_list_t* list, dmq_node_t* node)
312 312
 	while(cur) {
313 313
 		if(cmp_dmq_node(cur, node)) {
314 314
 			*prev = cur->next;
315
-			shm_free_node(cur);
315
+			destroy_dmq_node(cur, 1);
316 316
 			lock_release(&list->lock);
317 317
 			return 1;
318 318
 		}