From 8329d192be5b2bcd1be61634e0b689ecf2a810a8 Mon Sep 17 00:00:00 2001 From: Simon Tatham Date: Tue, 29 Jan 2019 20:15:43 +0000 Subject: [PATCH] uxnet: clean up callbacks when closing a NetSocket. uxnet.c's method for passing socket errors on to the Plug involves setting up a toplevel callback using the NetSocket itself as the context. Therefore, it should call delete_callbacks_for_context when it destroys a NetSocket. For example, if _two_ socket errors manage to occur, and the first one causes the socket to be closed, you need the second callback to not happen, or it'll dereference the freed pointer. --- unix/uxnet.c | 1 + 1 file changed, 1 insertion(+) diff --git a/unix/uxnet.c b/unix/uxnet.c index e01fea24..77a381f9 100644 --- a/unix/uxnet.c +++ b/unix/uxnet.c @@ -1022,6 +1022,7 @@ static void sk_net_close(Socket *sock) } if (s->addr) sk_addr_free(s->addr); + delete_callbacks_for_context(s); sfree(s); }