DISPATCH-2248: fix the dereference of a deliverys link work item

This closes apache#1364
kgiusti · Sep 8, 2021 · 12c524d · 12c524d
1 parent 27cf112
commit 12c524d
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 10 deletions.
diff --git a/src/router_core/forwarder.c b/src/router_core/forwarder.c
@@ -229,13 +229,12 @@ static void qdr_forward_drop_presettled_CT_LH(qdr_core_t *core, qdr_link_t *link
             // has no other deliveries associated with it, it can be removed
             // from the work list.
             //
-            assert(dlv->link_work);
-            if (dlv->link_work && (--dlv->link_work->value == 0)) {
+            if (--dlv->link_work->value == 0) {
                 DEQ_REMOVE(link->work_list, dlv->link_work);
                 qdr_link_work_release(dlv->link_work); // for work_list
-                qdr_link_work_release(dlv->link_work); // for dlv ref
-                dlv->link_work = 0;
             }
+            qdr_link_work_release(dlv->link_work); // for dlv ref
+            dlv->link_work = 0;
             dlv->disposition = PN_RELEASED;
             qdr_delivery_decref_CT(core, dlv, "qdr_forward_drop_presettled_CT_LH - remove from link-work list");
 

diff --git a/src/router_core/transfer.c b/src/router_core/transfer.c
@@ -300,16 +300,15 @@ void qdr_link_complete_sent_message(qdr_core_t *core, qdr_link_t *link)
     if (!!dlv && qdr_delivery_send_complete(dlv)) {
         DEQ_REMOVE_HEAD(link->undelivered);
         if (dlv->link_work) {
-            assert(dlv->link_work == link->work_list.head);
+            // ensure deliveries are sent in order:
+            assert(dlv->link_work == DEQ_HEAD(link->work_list));
             assert(dlv->link_work->value > 0);
-            dlv->link_work->value -= 1;
-
-            if (dlv->link_work->value == 0) {
+            if (--dlv->link_work->value == 0) {
                 DEQ_REMOVE_HEAD(link->work_list);
                 qdr_link_work_release(dlv->link_work);  // for work_list ref
-                qdr_link_work_release(dlv->link_work);  // for dlv ref
-                dlv->link_work = 0;
             }
+            qdr_link_work_release(dlv->link_work);  // for dlv ref
+            dlv->link_work = 0;
         }
 
         if (!dlv->settled && !qdr_delivery_oversize(dlv) && !qdr_delivery_is_aborted(dlv)) {