Fix crash on io when freeing core->files

radareorg · Mar 2, 2017 · 3cc8604 · 3cc8604
1 parent 34089ab
commit 3cc8604
Show file tree

Hide file tree

Showing 3 changed files with 28 additions and 30 deletions.
diff --git a/libr/core/file.c b/libr/core/file.c
@@ -893,19 +893,6 @@ R_API int r_core_file_close(RCore *r, RCoreFile *fh) {
 			ret = r_core_file_set_by_file (r, prev_cf);
 		}
 	}
-#if 0
-	{
-		RListIter *iter;
-		RIODesc *iod;
-		RCoreFile *mcf;
-		r_list_foreach (r->files, iter, mcf) {
-			r_cons_printf ("[cf]--> %p %p %d\n", mcf, mcf->desc, mcf->desc->fd);
-		}
-		r_list_foreach (r->io->files, iter, iod) {
-			r_cons_printf ("[io]--> %p %d\n", iod, iod->fd);
-		}
-	}
-#endif
 	return ret;
 }
 
@@ -1026,17 +1013,18 @@ R_API int r_core_file_binlist(RCore *core) {
 R_API int r_core_file_close_fd(RCore *core, int fd) {
 	RCoreFile *file;
 	RListIter *iter;
+	if (fd == -1) {
+		r_list_free (core->files);
+		core->files = NULL;
+		core->file = NULL;
+		return true;
+	}
 	r_list_foreach (core->files, iter, file) {
-		if (file->desc->fd == fd || fd == -1) {
+		if (file->desc->fd == fd) {
 			r_core_file_close (core, file);
 			if (file == core->file) {
 				core->file = NULL; // deref
 			}
-#if 0
-			if (r_list_empty (core->files)) {
-				core->file = NULL;
-			}
-#endif
 			return true;
 		}
 	}

diff --git a/libr/io/desc.c b/libr/io/desc.c
@@ -6,9 +6,10 @@
 // TODO: to be deprecated.. this is slow and boring
 
 R_API void r_io_desc_init(RIO *io) {
-	io->files = r_list_new ();
-	if (!io->files) return;
-	io->files->free = (RListFree)r_io_desc_free;
+	io->files = r_list_newf ((RListFree)r_io_desc_free);
+	if (!io->files) {
+		return;
+	}
 }
 
 R_API void r_io_desc_fini(RIO *io) {
@@ -91,11 +92,14 @@ R_API int r_io_desc_del(RIO *io, int fd) {
 	if (!r_list_empty (io->files)) {
 		io->desc = r_list_first (io->files);
 	}
+	if (fd == -1) {
+		r_list_free (io->files);
+		io->files = NULL;
+		return true;
+	}
 	/* No _safe loop necessary because we return immediately after the delete. */
 	r_list_foreach (io->files, iter, d) {
-		if (d->fd == fd || fd == -1) {
-			r_io_desc_free (d);
-			iter->data = NULL; // enforce free
+		if (d->fd == fd) {
 			r_list_delete (io->files, iter);
 			return true;
 		}
@@ -106,20 +110,24 @@ R_API int r_io_desc_del(RIO *io, int fd) {
 R_API RIODesc *r_io_desc_get(RIO *io, int fd) {
 	RListIter *iter;
 	RIODesc *d;
-	if (fd<0)
+	if (fd < 0) {
 		return NULL;
+	}
 	r_list_foreach (io->files, iter, d) {
-		if (d && d->fd == fd)
+		if (d && d->fd == fd) {
 			return d;
+		}
 	}
 	return NULL;
 }
 
 R_API ut64 r_io_desc_seek (RIO *io, RIODesc *desc, ut64 offset) {
-	if (!io || !desc)
+	if (!io || !desc) {
 		return UT64_MAX;
-	if (!desc->plugin)
+	}
+	if (!desc->plugin) {
 		return (ut64)lseek (desc->fd, offset, SEEK_SET);
+	}
 	return desc->plugin->lseek (io, desc, offset, SEEK_SET);
 }
 

diff --git a/libr/io/io.c b/libr/io/io.c
@@ -954,7 +954,9 @@ R_API int r_io_close(RIO *io, RIODesc *d) {
 
 R_API int r_io_close_all(RIO *io) {
 	// LOT OF MEMLEAKS HERE
-	if (!io) return 0;
+	if (!io) {
+		return 0;
+	}
 	r_cache_free (io->buffer);
 	io->buffer = r_cache_new (); // RCache is a list of ranged buffers. maybe rename?
 	io->write_mask_fd = -1;