httpd-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 29690] - allocator_free() crashes because of NULL-Pointer inside SSL_smart_shutdown()
Date Sat, 19 Jun 2004 21:20:04 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG 
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=29690>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND 
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=29690

allocator_free() crashes because of NULL-Pointer inside SSL_smart_shutdown()





------- Additional Comments From cra@gedas.de  2004-06-19 21:20 -------
Just found out that active->next ist set to NULL in the line just before the 
allocator_free() call at the end of apr_pool_clear():

----------------------------- snip -----------------------------
    if (active->next == active)  /* apr_pools.c, line 709 */
        return;

    *active->ref = NULL;
    allocator_free(pool->allocator, active->next);
----------------------------- snip -----------------------------

The '*active->ref = NULL;' statement sets active->next to NULL. It was *NOT* 
NULL before that statement.

Obviously, 'active->ref' pointed to the *own* 'next' field.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org


Mime
View raw message