Edit

kc3-lang/libevent

Branch :

  • Show log

    Commit

  • Author : Nick Mathewson
    Date : 2010-03-13 01:04:30
    Hash : 0cf1431e
    Message : Avoid an (untriggerable so far) crash bug in bufferevent_free() We were saying mm_free(bufev - bufev->be_ops->mem_offset); when we should have said mm_free(((char*)bufev) - bufev->be_ops->mem_offset); In other words, if mem_offset had ever been nonzero, then instead of backing up mem_offset bytes to find the thing we were supposed to free, we would have backed up mem_offset*sizeof(struct bufferevent) bytes, and freed something completely crazy. Spotted thanks to a conversation with Jardel Weyrich