[bug #26024] crash in NSNotificationQueue dealloc (PATCH included)

[Mike McCauley]

URL:
  <http://savannah.gnu.org/bugs/?26024>

                 Summary: crash in NSNotificationQueue dealloc (PATCH
included)
                 Project: GNUstep
            Submitted by: mikem
            Submitted on: Fri 27 Mar 2009 05:56:36 AM GMT
                Category: Base/Foundation
                Severity: 3 - Normal
              Item Group: Bug
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any

    _______________________________________________________

Details:

crash in NSNotificationQueue dealloc

Observed in gnustep-base-1.18.0. Same broken code is in 1.19.0 Crash observed
with Cygwin 1.5 on Windows server 2003, using gcc 4.3.

The bug occurs when remove_from_queue is called (which frees the item) before
the item->prev link is fetched. At the end of the iteration, item will have
been freed and item->prev may already be clobbered depending on the platform.






    _______________________________________________________

File Attachments:


-------------------------------------------------------
Date: Fri 27 Mar 2009 05:56:36 AM GMT  Name: NSNotificationQueue.diff  Size:
830B   By: mikem
diff -u patch file
<http://savannah.gnu.org/bugs/download.php?file_id=17816>

    _______________________________________________________

Reply to this item at:

  <http://savannah.gnu.org/bugs/?26024>

_______________________________________________
  Message sent via/by Savannah
  http://savannah.gnu.org/