Hi!

I'm afraid that a memory leak has been introduced with my patch: the
header h in obex_object_send() may be freed from the subroutines
send_stream() or send_body(). The condition (h->flags & OBEX_FL_SUSPEND)
has to checked before calling these subroutines. Attached is a patch
that changes obex_object_send() accordingly.

Best regards,

  Martin


Am Freitag, den 10.02.2006, 10:01 +0100 schrieb Martin Schulze:
> ? I sent the split patches to the mailing list on Wednesday evening.
> Hang on, the mail is not in the archive - something went wrong.
> 
> Sorry for that.
> 
>   Martin
> 
> 
> Am Freitag, den 10.02.2006, 02:19 +0100 schrieb Marcel Holtmann:
> > Hi Martin,
> > 
> > > > Anyway, I've attached the patch to this email.
> > > 
> > > Please split this patch into two, because non of them are related. And
> > > skip modifying the ChangeLog file. The revision history will be inside
> > > the CVS and I update the master ChangeLog file on every release.
> > 
> > I now did this by myself :(
> > 
> > Regards
> > 
> > Marcel
> > 
> > 
> > 
> > 
> > -------------------------------------------------------
> > This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> > for problems?  Stop!  Download the new AJAX search engine that makes
> > searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> > _______________________________________________
> > Openobex-users mailing list
> > [email protected]
> > http://lists.sourceforge.net/lists/listinfo/openobex-users
> 
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> Openobex-users mailing list
> [email protected]
> http://lists.sourceforge.net/lists/listinfo/openobex-users
Index: lib/obex_object.c
===================================================================
RCS file: /cvsroot/openobex/openobex/lib/obex_object.c,v
retrieving revision 1.25
diff -u -3 -r1.25 obex_object.c
--- lib/obex_object.c	10 Feb 2006 01:18:05 -0000	1.25
+++ lib/obex_object.c	26 Feb 2006 14:27:28 -0000
@@ -431,7 +431,7 @@
 	int actual, finished = 0;
 	uint16_t tx_left;
 	int addmore = TRUE;
-	int free_h, real_opcode;
+	int real_opcode;
 
 	DEBUG(4, "\n");
 
@@ -473,35 +473,40 @@
 	while(addmore == TRUE && object->tx_headerq != NULL) {
 
 		h = object->tx_headerq->data;
-		free_h = FALSE;
 
 		if(h->stream) {
 			/* This is a streaming body */
+			if(h->flags & OBEX_FL_SUSPEND)
+				object->suspend = 1;
 			actual = send_stream(self, h, txmsg, tx_left);
 			if(actual < 0 )
 				return -1;
 			tx_left -= actual;
-			if (object->suspend)
-				addmore = FALSE;
 		}
 		else if(h->hi == OBEX_HDR_BODY) {
 			/* The body may be fragmented over several packets. */
+			if(h->flags & OBEX_FL_SUSPEND)
+				object->suspend = 1;
 			tx_left -= send_body(object, h, txmsg, tx_left);
 		}
 		else if(h->hi == OBEX_HDR_EMPTY) {
+			if(h->flags & OBEX_FL_SUSPEND)
+				object->suspend = 1;
 			object->tx_headerq = slist_remove(object->tx_headerq, h);
-			free_h = TRUE;
+			free(h);
 		}
 		else if(h->length <= tx_left) {
 			/* There is room for more data in tx msg */
 			DEBUG(4, "Adding non-body header\n");
 			g_netbuf_put_data(txmsg, h->buf->data, h->length);
 			tx_left -= h->length;
+			if(h->flags & OBEX_FL_SUSPEND)
+				object->suspend = 1;
 				
 			/* Remove from tx-queue */
 			object->tx_headerq = slist_remove(object->tx_headerq, h);
 			g_netbuf_free(h->buf);
-			free_h = TRUE;
+			free(h);
 		}
 		else if(h->length > self->mtu_tx) {
 			/* Header is bigger than MTU. This should not happen,
@@ -516,13 +521,8 @@
 			addmore = FALSE;
 		}
 
-		if (h->flags & OBEX_FL_SUSPEND) {
-			object->suspend = 1;
+		if (object->suspend)
 			addmore = FALSE;
-		}
-
-		if(free_h)
-			free(h);
 
 		if (tx_left == 0)
 			addmore = FALSE;

Reply via email to