mirror of
https://github.com/TrinityCore/TrinityCore.git
synced 2026-01-27 04:12:40 +01:00
Core/RA: Fix a possible crash
Caused when RASocket::handle_close (event-driven) would delete the underlying object before RASocket::commandFinished callback was executed for that object. Dereferencing freed pointers is bad.
This commit is contained in:
@@ -59,7 +59,6 @@ int RASocket::handle_close(ACE_HANDLE, ACE_Reactor_Mask)
|
||||
sLog->outInfo(LOG_FILTER_REMOTECOMMAND, "Closing connection");
|
||||
peer().close_reader();
|
||||
wait();
|
||||
destroy();
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -412,10 +411,12 @@ void RASocket::commandFinished(void* callbackArg, bool /*success*/)
|
||||
|
||||
// the message is 0 size control message to tell that command output is finished
|
||||
// hence we don't put timeout, because it shouldn't increase queue size and shouldn't block
|
||||
if (socket->putq(mb) == -1)
|
||||
{
|
||||
if (socket->peer().get_handle() == ACE_INVALID_HANDLE // this can happen if this code is triggered when handle_close has already called peer().close_writer()
|
||||
|| socket->putq(mb->duplicate()) == -1)
|
||||
// getting here is bad, command can't be marked as complete
|
||||
sLog->outDebug(LOG_FILTER_REMOTECOMMAND, "Failed to enqueue command end message. Error is %s", ACE_OS::strerror(errno));
|
||||
mb->release();
|
||||
}
|
||||
|
||||
mb->release();
|
||||
socket->destroy(); // deletes the object
|
||||
socket = NULL;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user