Changeset 8755 for trunk/src

Timestamp:

Jun 25, 2002, 9:11:58 AM (23 years ago)

Author:

sandervl

Message:

KSO: Bad linked list walking. (accessed node after free)

File:

• trunk/src/shell32/changenotify.c (modified) (8 diffs)

trunk/src/shell32/changenotify.c

@@ -1 @@
-/* $Id: changenotify.c,v 1.3 2002-06-09 12:41:20 sandervl Exp $ */
+/* $Id: changenotify.c,v 1.4 2002-06-25 07:11:58 sandervl Exp $ */
 /*
  *      shell change notification
@@ -26 +26 @@
 {
         struct _NOTIFICATIONLIST *next;
-        struct _NOTIFICATIONLIST *prev; 
+        struct _NOTIFICATIONLIST *prev;
         HWND hwnd;              /* window to notify */
         DWORD uMsg;             /* message to send */
@@ -55 +55 @@
 
         while(ptr != &tail)
-        { 
+        {
           int i;
           item = ptr;
@@ -61 +61 @@
 
           TRACE("item=%p\n", item);
-          
+        
           /* free the item */
           for (i=0; i<item->cidl;i++) SHFree(item->apidl[i].pidlPath);
@@ -106 +106 @@
 
         ptr = head.next;
+#ifdef __WIN32OS2__
+        while((ptr != &tail)/* && (ret == FALSE) see the rant below */)
+#else
         while((ptr != &tail) && (ret == FALSE))
-        { 
+#endif
+        {
           TRACE("ptr=%p\n", ptr);
-          
+        
           if (ptr == item)
           {
             int i;
-            
+        
             TRACE("item=%p prev=%p next=%p\n", item, item->prev, item->next);
 
@@ -124 +128 @@
             SHFree(item->apidl);
             SHFree(item);
-            ret = TRUE;
+#ifdef __WIN32OS2__
+            /* ret = TRUE;
+             * <rant> HEY! Have you guys ever heard about the break keyword?
+             * And please don't test if ret == FALSE. Test !ret!!! </rant>
+             * Anyway, ptr == item, we free item hence the memory shouldn't be
+             * accessed by us any longer. We have to break here so we do NOT do
+             * the next operation below!
+             * -bird-
+             */
+            break;
+#else
+            ret = TRUE;
+#endif
           }
           ptr = ptr->next;
@@ -222 +238 @@
         {
           TRACE("trying %p\n", ptr);
-          
+        
           if(wEventId & ptr->wEventMask)
           {
@@ -268 +284 @@
         {
           TRACE("trying %p\n", ptr);
-          
+        
           if(wEventId & ptr->wEventMask)
           {