<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:krh@bitplanet.net" title="Kristian Høgsberg <krh@bitplanet.net>"> <span class="fn">Kristian Høgsberg</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - wayland-client.c:dispatch_event() dereferences proxy after free"
href="https://bugs.freedesktop.org/show_bug.cgi?id=61385">bug 61385</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - wayland-client.c:dispatch_event() dereferences proxy after free"
href="https://bugs.freedesktop.org/show_bug.cgi?id=61385#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - wayland-client.c:dispatch_event() dereferences proxy after free"
href="https://bugs.freedesktop.org/show_bug.cgi?id=61385">bug 61385</a>
from <span class="vcard"><a class="email" href="mailto:krh@bitplanet.net" title="Kristian Høgsberg <krh@bitplanet.net>"> <span class="fn">Kristian Høgsberg</span></a>
</span></b>
<pre>commit e053a5625129bd11c301c9587f5f29cbda95c66d
Author: Jonas Ådahl <<a href="mailto:jadahl@gmail.com">jadahl@gmail.com</a>>
Date: Thu Mar 7 23:32:39 2013 +0100
client: Check reference count only for destroyed proxies
The llvm static analyzer tool reported "Use of memory after it is freed"
in dispatch_event() because the proxy is used after being freed if the
reference count reaches zero without the destroyed flag being set. This
would never happen in practice because the owner of the proxy object
always holds a reference until calling wl_proxy_destroy() which would
also set the destroyed flag.
Since this is the case, it is safe to do the reference count check only
if the destroyed flag is set, as it can never reach zero if not.
This commit doesn't change the behavior of the function, but makes the
static analyzer more happy.
Fixes <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - wayland-client.c:dispatch_event() dereferences proxy after free"
href="show_bug.cgi?id=61385">https://bugs.freedesktop.org/show_bug.cgi?id=61385</a>
Signed-off-by: Jonas Ådahl <<a href="mailto:jadahl@gmail.com">jadahl@gmail.com</a>></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>