FUM errors. we're accessing 'sc' after it gets freed by a callback.

Wrapping storeClientCopy2() with cbdataLock/Unlock should prevent
it from being freed until the end of this function.
Gross solution.

diff --git a/src/store_client.cc b/src/store_client.cc
index f02121a3bbe92a9ab59fe27ff8d8fbe63c42c1bd..23dd326597139e12913f2f1b5e1cd7c19ba7c136 100644 (file)
--- a/src/store_client.cc
+++ b/src/store_client.cc
@@ -143,6 +143,7 @@ storeClientCopy2(StoreEntry * e, store_client * sc)
        eventAdd("storeClientCopyEvent", storeClientCopyEvent, sc, 0, 0);
        return;
     }
+    cbdataLock(sc);            /* ick, prevent sc from getting freed */
     sc->flags.store_copying = 1;
     debug(20, 3) ("storeClientCopy2: %s\n", storeKeyText(e->key));
     assert(callback != NULL);
@@ -211,6 +212,7 @@ storeClientCopy2(StoreEntry * e, store_client * sc)
        }
     }
     sc->flags.store_copying = 0;
+    cbdataUnlock(sc);          /* ick, allow sc to be freed */
 }
 
 static void