From: Volker Lendecke <vl@samba.org>
Date: Thu, 31 Jan 2013 15:34:41 +0000 (+0100)
Subject: tevent_poll: Avoid a crash in poll_fresh_fde_destructor
X-Git-Tag: tevent-0.9.18~344
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=611fcca641a22a2a23b26752105af99cf338d6a1;p=thirdparty%2Fsamba.git

tevent_poll: Avoid a crash in poll_fresh_fde_destructor

The event context might have been freed before the fde

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/lib/tevent/tevent_poll.c b/lib/tevent/tevent_poll.c
index 0c580e49eec..f63173744fa 100644
--- a/lib/tevent/tevent_poll.c
+++ b/lib/tevent/tevent_poll.c
@@ -218,8 +218,15 @@ done:
 
 static int poll_fresh_fde_destructor(struct tevent_fd *fde)
 {
-	struct poll_event_context *poll_ev = talloc_get_type_abort(
-		fde->event_ctx->additional_data, struct poll_event_context);
+	struct tevent_context *ev = fde->event_ctx;
+	struct poll_event_context *poll_ev;
+
+	if (ev == NULL) {
+		return 0;
+	}
+	poll_ev = talloc_get_type_abort(
+		ev->additional_data, struct poll_event_context);
+
 	DLIST_REMOVE(poll_ev->fresh, fde);
 	return 0;
 }