From: 윤정현 <jh0506.yun@samsung.com>

Subject: Re: [E-devel] [Patch] ecore_ipc - remove potential risk in
ecore_ipc_shutdown

I found a problem this infinite loop case.

If server is deleted, then ECORE_IPC_EVENT_SERVER_DEL callback
function will be called in client side.
It will happen infinite loop in ecore_ipc_shutdown if
ecore_ipc_shutdown called in this ECORE_IPC_EVENT_SERVER_DEL callback
function.

For example,
server_del_handler =
ecore_event_handler_add(ECORE_IPC_EVENT_SERVER_DEL, _server_del_cb, NULL);
static Eina_Bool
_server_del_cb(void *data, int type, void *event)
{
   ecore_ipc_shutdown();
   return EINA_TRUE;
 }

If server is deleted,
1. _ecore_ipc_event_server_del : svr->event_count++
2. _server_del_cb : ecore_ipc_shutdown called
3. ecore_ipc_shutdown : while (servers) ecore_ipc_server_del(eina_list_data_get(servers))
4. ecore_ipc_server_del : can't eina_list_remove(servers, svr) because event_count != 0
5. infinite loop

I think this while code is very dangerous whether user miss or not.
I modified EINA_LIST_FOREACH_SAFE instead of EINA_LIST_FOREACH refer
to ecore_con.
Please review this patch.

git-svn-id: svn+ssh://svn.enlightenment.org/var/svn/e/trunk/ecore@67874 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33

diff --git a/src/lib/ecore_ipc/ecore_ipc.c b/src/lib/ecore_ipc/ecore_ipc.c
index e27134d..0210f1d 100644 (file)
--- a/src/lib/ecore_ipc/ecore_ipc.c
+++ b/src/lib/ecore_ipc/ecore_ipc.c
@@ -316,7 +316,10 @@ ecore_ipc_shutdown(void)
    if (--_ecore_ipc_init_count != 0)
      return _ecore_ipc_init_count;
 
-   while (servers) ecore_ipc_server_del(eina_list_data_get(servers));
+   Eina_List *l, *l2;
+   Ecore_Ipc_Server *svr;
+   EINA_LIST_FOREACH_SAFE(servers, l, l2, svr)
+     ecore_ipc_server_del(svr);
 
    for (i = 0; i < 6; i++)
      ecore_event_handler_del(handler[i]);