From d7f57132772e69c2f9f3596c6525d9d37393f9be Mon Sep 17 00:00:00 2001 From: irungentoo Date: Thu, 11 Dec 2014 13:54:55 -0500 Subject: [PATCH] Fixed crash when connection was killed during the packet callback. --- toxcore/friend_connection.c | 10 ++++++++++ toxcore/net_crypto.c | 9 ++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/toxcore/friend_connection.c b/toxcore/friend_connection.c index aaffe02f..894ba61a 100644 --- a/toxcore/friend_connection.c +++ b/toxcore/friend_connection.c @@ -274,6 +274,11 @@ static int handle_packet(void *object, int number, uint8_t *data, uint16_t lengt if (friend_con->callbacks[i].data_callback) friend_con->callbacks[i].data_callback(friend_con->callbacks[i].data_callback_object, friend_con->callbacks[i].data_callback_id, data, length); + + friend_con = get_conn(fr_c, number); + + if (!friend_con) + return -1; } return 0; @@ -296,6 +301,11 @@ static int handle_lossy_packet(void *object, int number, const uint8_t *data, ui if (friend_con->callbacks[i].lossy_data_callback) friend_con->callbacks[i].lossy_data_callback(friend_con->callbacks[i].lossy_data_callback_object, friend_con->callbacks[i].lossy_data_callback_id, data, length); + + friend_con = get_conn(fr_c, number); + + if (!friend_con) + return -1; } return 0; diff --git a/toxcore/net_crypto.c b/toxcore/net_crypto.c index bcb1dc6d..be2f967d 100644 --- a/toxcore/net_crypto.c +++ b/toxcore/net_crypto.c @@ -1180,6 +1180,12 @@ static int handle_data_packet_helper(const Net_Crypto *c, int crypt_connection_i if (conn->connection_data_callback) conn->connection_data_callback(conn->connection_data_callback_object, conn->connection_data_callback_id, dt.data, dt.length); + + /* conn might get killed in callback. */ + conn = get_crypto_connection(c, crypt_connection_id); + + if (conn == 0) + return -1; } /* Packet counter. */ @@ -1187,11 +1193,12 @@ static int handle_data_packet_helper(const Net_Crypto *c, int crypt_connection_i } else if (real_data[0] >= PACKET_ID_LOSSY_RANGE_START && real_data[0] < (PACKET_ID_LOSSY_RANGE_START + PACKET_ID_LOSSY_RANGE_SIZE)) { + set_buffer_end(&conn->recv_array, num); + if (conn->connection_lossy_data_callback) conn->connection_lossy_data_callback(conn->connection_lossy_data_callback_object, conn->connection_lossy_data_callback_id, real_data, real_length); - set_buffer_end(&conn->recv_array, num); } else { return -1; }