From 518a192ec7158840d8337a22e6bd303ab204aa46 Mon Sep 17 00:00:00 2001
From: hno <>
Date: Sat, 1 Feb 2003 20:38:44 +0000
Subject: [PATCH] Bug #507: Crash after ftpDataWriteCallback

A cbdata fence error when aborting FTP requests caused Squid to segfault
if a FTP PUT request was aborted while Squid was actively sending data
to the FTP server.

It is possible this fence error could also be triggered by other abort
conditions in FTP such as timeouts etc, producing slightly different symptoms.
---
 src/ftp.cc | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/ftp.cc b/src/ftp.cc
index d5b3877826..a3b6828e3b 100644
--- a/src/ftp.cc
+++ b/src/ftp.cc
@@ -1,6 +1,6 @@
 
 /*
- * $Id: ftp.cc,v 1.338 2003/01/23 00:37:21 robertc Exp $
+ * $Id: ftp.cc,v 1.339 2003/02/01 13:38:44 hno Exp $
  *
  * DEBUG: section 9     File Transfer Protocol (FTP)
  * AUTHOR: Harvest Derived
@@ -270,6 +270,13 @@ FTPSM *FTP_SM_FUNCS[] =
 
 static void
 ftpStateFree(int fdnotused, void *data)
+{
+    FtpStateData *ftpState = (FtpStateData *)data;
+    cbdataFree(ftpState);
+}
+
+static void
+ftpStateFreed(void *data)
 {
     FtpStateData *ftpState = (FtpStateData *)data;
     if (ftpState == NULL)
@@ -309,7 +316,6 @@ ftpStateFree(int fdnotused, void *data)
 	comm_close(ftpState->data.fd);
 	ftpState->data.fd = -1;
     }
-    cbdataFree(ftpState);
 }
 
 static void
@@ -1060,7 +1066,7 @@ ftpStart(FwdState * fwd)
     FtpStateData *ftpState;
     HttpReply *reply;
 
-    CBDATA_INIT_TYPE(FtpStateData);
+    CBDATA_INIT_TYPE_FREECB(FtpStateData, ftpStateFreed);
     ftpState = cbdataAlloc(FtpStateData);
     debug(9, 3) ("ftpStart: '%s'\n", url);
     statCounter.server.all.requests++;
@@ -1705,6 +1711,9 @@ ftpSendPasv(FtpStateData * ftpState)
      * to delete the close handler which did NOT get called
      * to prevent ftpStateFree() getting called twice.
      * Instead we'll always call comm_close() on the ctrl FD.
+     *
+     * XXX this should not actually matter if the ftpState is cbdata
+     * managed correctly and comm close handlers are cbdata fenced
      */
     ftpState->data.fd = fd;
     snprintf(cbuf, 1024, "PASV\r\n");
-- 
2.47.3