In the function apr_sms_destroy() in the file apr_sms.c the function appears 
to be using free() to destroy a lock which has already been destroyed.  On 
about #597 the follow code appears:

    /* Remove the memory system from the parent memory systems child list */
    if (pms) {
        if (pms->sms_lock)
            apr_lock_acquire(pms->sms_lock);
        
        if ((*sms->ref = sms->sibling) != NULL)
            sms->sibling->ref = sms->ref;

        if (pms->sms_lock)
            apr_lock_release(pms->sms_lock);
    }
    
    /* Call the pre-destroy if present */
    if (sms->pre_destroy_fn)
        sms->pre_destroy_fn(sms);

    if (sms->sms_lock)
    {
        apr_lock_destroy(sms->sms_lock);
        if (pms->free_fn)
            apr_sms_free(sms->parent, sms->sms_lock);
    }


In the last outer if statement a call is made to destroy the sms->sms_lock 
which should completely destroy and free the lock.  In the next if statement a 
call to apr_sms_free () then tries to free it again.  When traced through it 
ultimately calls free() on sms->sms_lock which should have already been 
destroyed by the call to apr_lock_destroy().  Am I missing something or is the 
code trying to free a lock that has already been destroyed?

Brad

Reply via email to