From: Jaroslav Kysela <perex@perex.cz>
Date: Tue, 8 Jan 2019 19:26:02 +0000 (+0100)
Subject: avahi: try to fix double free, fixes #5484
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fdafda55c5b9be93abb6df1f61cfeed5d8e19dff;p=thirdparty%2Ftvheadend.git

avahi: try to fix double free, fixes #5484
---

diff --git a/src/avahi.c b/src/avahi.c
index 9f22eaff4..8372c405d 100644
--- a/src/avahi.c
+++ b/src/avahi.c
@@ -55,7 +55,7 @@
 #include "config.h"
 
 static AvahiEntryGroup *group = NULL;
-static char *name = NULL;
+static char *name = NULL, *name2 = NULL;
 static AvahiSimplePoll *avahi_asp = NULL;
 static const AvahiPoll *avahi_poll = NULL;
 static int avahi_do_restart = 0;
@@ -89,7 +89,7 @@ entry_group_callback(AvahiEntryGroup *g, AvahiEntryGroupState state,
     /* A service name collision with a remote service
      * happened. Let's pick a new name */
     n = avahi_alternative_service_name(name);
-    avahi_free(name);
+    if (name != name2) avahi_free(name);
     name = n;
     
     tvherror(LS_AVAHI, "Service name collision, renaming service to '%s'", name);
@@ -200,7 +200,7 @@ create_services(AvahiClient *c)
   /* A service name collision with a local service happened. Let's
    * pick a new name */
   n = avahi_alternative_service_name(name);
-  avahi_free(name);
+  if (name != name2) avahi_free(name);
   name = n;
 
   tvherror(LS_AVAHI, "Service name collision, renaming service to '%s'", name);
@@ -268,7 +268,6 @@ static void *
 avahi_thread(void *aux)
 {
   AvahiClient *ac;
-  char *name2;
 
   do {
     if (avahi_poll)
@@ -296,6 +295,7 @@ avahi_thread(void *aux)
 
     name = NULL;
     avahi_free(name2);
+    name2 = NULL;
 
   } while (tvheadend_is_running() && avahi_do_restart);
 
diff --git a/src/tvh_thread.c b/src/tvh_thread.c
index 6ddb9ad64..d942fbda4 100644
--- a/src/tvh_thread.c
+++ b/src/tvh_thread.c
@@ -496,14 +496,18 @@ tvh_thread_mutex_failed
 #if ENABLE_TRACE
 static void *tvh_thread_watch_thread(void *aux)
 {
-  int64_t now;
+  int64_t now, limit;
   tvh_mutex_t *mutex, dmutex;
+  const char *s;
 
+  s = getenv("TVHEADEND_THREAD_WATCH_LIMIT");
+  limit = s ? atol(s) : 5;
+  limit = MINMAX(limit, 5, 120);
   while (!atomic_get(&tvhwatch_done)) {
     pthread_mutex_lock(&thrwatch_mutex);
     now = getfastmonoclock();
     mutex = TAILQ_LAST(&thrwatch_mutexes, tvh_mutex_queue);
-    if (mutex && mutex->tstamp + sec2mono(5) < now) {
+    if (mutex && mutex->tstamp + sec2mono(limit) < now) {
       pthread_mutex_unlock(&thrwatch_mutex);
       tvh_thread_mutex_failed(mutex, "deadlock", __FILE__, __LINE__);
     }