diff options
| author | John Ohl <john@collabriasoftware.com> | 2014-09-16 22:25:52 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2014-09-18 11:37:28 -0400 |
| commit | 3cc0eace2e3fb72310af7d7f8c0f8ffac6cb1635 (patch) | |
| tree | adbfe6fbe77ded9913dedf535a99132044e306bc /event.c | |
| parent | 35f107de922ef64b2b1809af9b6ebe5db1abbb33 (diff) | |
| download | libevent-3cc0eace2e3fb72310af7d7f8c0f8ffac6cb1635.tar.gz | |
Fix use-after-free error in EV_CLOSURE_EVENT callback
Diffstat (limited to 'event.c')
| -rw-r--r-- | event.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -1569,8 +1569,9 @@ event_process_active_single_queue(struct event_base *base, event_persist_closure(base, ev); break; case EV_CLOSURE_EVENT: { - void (*evcb_callback)(evutil_socket_t, short, void *) = *ev->ev_callback; + void (*evcb_callback)(evutil_socket_t, short, void *); EVUTIL_ASSERT(ev != NULL); + evcb_callback = *ev->ev_callback; EVBASE_RELEASE_LOCK(base, th_base_lock); evcb_callback(ev->ev_fd, ev->ev_res, ev->ev_arg); } |