msg_Unsubscribe: race condition memory leak
authorRémi Denis-Courmont <rdenis@simphalempin.com>
Wed, 15 Oct 2008 16:11:22 +0000 (19:11 +0300)
committerRémi Denis-Courmont <rdenis@simphalempin.com>
Wed, 15 Oct 2008 16:11:22 +0000 (19:11 +0300)
src/misc/messages.c

index 087d9cd..29031f0 100644 (file)
@@ -275,6 +275,15 @@ void msg_Unsubscribe (msg_subscription_t *sub)
     vlc_mutex_unlock (&bank->lock);
 
     vlc_join (sub->thread, NULL);
+
+    /* Free dangling (not flushed) messages. */
+    /* NOTE: no locking, only this thread can refer to the subscription now. */
+    while (sub->begin != sub->end)
+    {
+        msg_Release (sub->items[sub->begin]);
+        if (++sub->begin == VLC_MSG_QSIZE)
+            sub->begin = 0;
+    }
     free (sub);
 }