On Fri, 10 Feb 2012 03:11:32 +0000 (GMT) 윤정현 <jh0506....@samsung.com> said:
in svn! this is acceptable! thanks! :)
> I found a problem this infinite loop case.
>
> If server is deleted, then ECORE_IPC_EVENT_SERVER_DEL callback function will
> be called in client side. It will happen infinite loop in ecore_ipc_shutdown
> if ecore_ipc_shutdown called in this ECORE_IPC_EVENT_SERVER_DEL callback
> function.
>
> For example,
> server_del_handler = ecore_event_handler_add(ECORE_IPC_EVENT_SERVER_DEL,
> _server_del_cb, NULL); static Eina_Bool
> _server_del_cb(void *data, int type, void *event)
> {
> ecore_ipc_shutdown();
> return EINA_TRUE;
> }
>
> If server is deleted,
> 1. _ecore_ipc_event_server_del : svr->event_count++
> 2. _server_del_cb : ecore_ipc_shutdown called
> 3. ecore_ipc_shutdown : while (servers) ecore_ipc_server_del
> (eina_list_data_get(servers))
> 4. ecore_ipc_server_del : can't eina_list_remove(servers, svr) because
> event_count != 0
> 5. infinite loop
>
> I think this while code is very dangerous whether user miss or not.
> I modified EINA_LIST_FOREACH_SAFE instead of EINA_LIST_FOREACH refer to
> ecore_con. Please review this patch.
>
> Thanks.
>
> ------- Original Message -------
> Sender : Carsten Haitzler<ras...@rasterman.com>
> Date : 2012-02-02 18:00 (GMT+09:00)
> Title : Re: [E-devel] [Patch] ecore_ipc - remove potential risk in
> ecore_ipc_shutdown
>
> On Wed, 01 Feb 2012 03:06:01 +0000 (GMT) Jeong-Hyun Yun
> <jh0506....@samsung.com> said:
>
> > Dear All.
> >
> > I removed potential risk in ecore_ipc_shutdown.
> >
> > If servers can't eina_list removed in ecore_ipc_server_del(),
> > for example, delete_me is true or event_count == 0 or etc.,
> > then the while loop will be infinite.
> >
> > I modified EINA_LIST_FOREACH instead of while loop.
> >
> > Please review this patch.
>
> this is dangerous. very. take a look at this line in ecore_ipc_server_del():
>
> servers = eina_list_remove(servers, svr);
>
> so what happens when as you walk a list.. you remove the exact item you are
> walking... then you try use the list node ->next member.. that you just
> freed? :)
>
> this is not a fix. it's asking for segv's.
>
> you issue is this:
>
> if (svr->event_count == 0)
>
>
> ie it wont remove until events have been spooled out from the server. this
> wont happen until the mainloop goes and runs again, so you have a problem.
> what i'd do is have a routine before u server_del that finds all events for
> that server and deletes them. :) the problem is that there isn't a list of
> these per server. all the events point back to this server so u basically
> have a referencing issue. if a ref that wont be removed until mainlooop
> flushes the events. you want to look over there.
>
> --
> ------------- Codito, ergo sum - "I code, therefore I am" --------------
> The Rasterman (Carsten Haitzler) ras...@rasterman.com
>
> <p> </p><p> </p>
--
------------- Codito, ergo sum - "I code, therefore I am" --------------
The Rasterman (Carsten Haitzler) ras...@rasterman.com
------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,
Metro Style Apps, more. Free future releases when you subscribe now!
http://p.sf.net/sfu/learndevnow-dev2
_______________________________________________
enlightenment-devel mailing list
enlightenment-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/enlightenment-devel
