STABLE14-rx-current-packet-double-free-20081003

LICENSE MIT

in rxi_WriteProc() make sure that rx_call currentPacket is
set to NULL after the rx_packet is added to a queue or
passed to rx_freePacket().  Otherwise we will panic when
we attempt to call rx_freePacket twice on the same packet.

(cherry picked from commit 1e7203940456e783aad215e939c04ed01dd45599)

diff --git a/src/rx/rx_rdwr.c b/src/rx/rx_rdwr.c
index 735e4da50514e1538e0732232b8c8066cfa29909..bcaa11870d5a4d4bde9c61c2b932235c97f0021c 100644 (file)
--- a/src/rx/rx_rdwr.c
+++ b/src/rx/rx_rdwr.c
@@ -1100,6 +1100,7 @@ rxi_WritevProc(struct rx_call *call, struct iovec *iov, int nio, int nbytes)
            hadd32(call->bytesSent, cp->length);
            rxi_PrepareSendPacket(call, cp, 0);
            queue_Append(&tmpq, cp);
+            cp = call->currentPacket = (struct rx_packet *)0;
 
            /* The head of the iovq is now the current packet */
            if (nbytes) {