On Thu, Mar 07, 2013 at 11:32:39PM +0100, Jonas Ådahl wrote:
> The llvm static analyzer tool reported "Use of memory after it is freed"
> in dispatch_event() because the proxy is used after being freed if the
> reference count reaches zero without the destroyed flag being set. This
> would never happen in practice because the owner of the proxy object
> always holds a reference until calling wl_proxy_destroy() which would
> also set the destroyed flag.
> 
> Since this is the case, it is safe to do the reference count check only
> if the destroyed flag is set, as it can never reach zero if not.
> 
> This commit doesn't change the behavior of the function, but makes the
> static analyzer more happy.
> 
> Fixes https://bugs.freedesktop.org/show_bug.cgi?id=61385

Yes, looks fine, thanks.

Kristian

> Signed-off-by: Jonas Ådahl <[email protected]>
> ---
>  src/wayland-client.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/src/wayland-client.c b/src/wayland-client.c
> index 74e4657..3ead2ac 100644
> --- a/src/wayland-client.c
> +++ b/src/wayland-client.c
> @@ -822,10 +822,10 @@ dispatch_event(struct wl_display *display, struct 
> wl_event_queue *queue)
>       proxy_destroyed = !!(proxy->flags & WL_PROXY_FLAG_DESTROYED);
>  
>       proxy->refcount--;
> -     if (!proxy->refcount)
> -             free(proxy);
> -
>       if (proxy_destroyed) {
> +             if (!proxy->refcount)
> +                     free(proxy);
> +
>               wl_closure_destroy(closure);
>               return;
>       }
> -- 
> 1.7.10.4
> 
> _______________________________________________
> wayland-devel mailing list
> [email protected]
> http://lists.freedesktop.org/mailman/listinfo/wayland-devel
_______________________________________________
wayland-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/wayland-devel

Reply via email to