ecore-audio: defer deletion of pulseaudio timer until after event processing

==27523== Invalid write of size 8
==27523==    at 0x9E855F5: _ecore_time_wrapper (ecore_audio_pulse_ml.c:132)
==27523==    by 0x647E5CF: _ecore_call_task_cb (ecore_private.h:336)
==27523==    by 0x647FB8B: _ecore_timer_expired_call (ecore_timer.c:733)
==27523==    by 0x647F9EE: _ecore_timer_expired_timers_call (ecore_timer.c:686)
==27523==    by 0x647B4CE: _ecore_main_loop_iterate_internal (ecore_main.c:1814)
==27523==    by 0x647998E: ecore_main_loop_begin (ecore_main.c:983)
==27523==    by 0x4E4F676: elm_run (elm_main.c:1099)
==27523==    by 0x12801B: elm_main (test.c:1010)
==27523==    by 0x1280C4: main (test.c:1021)
==27523==  Address 0x20537208 is 8 bytes inside a block of size 56 free'd
==27523==    at 0x4A07D6A: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==27523==    by 0x9E858ED: _ecore_pa_time_free (ecore_audio_pulse_ml.c:204)
==27523==    by 0x108DB350: free_events (socket-client.c:109)
==27523==    by 0x108DBA53: do_call (socket-client.c:157)
==27523==    by 0x9E855F0: _ecore_time_wrapper (ecore_audio_pulse_ml.c:131)
==27523==    by 0x647E5CF: _ecore_call_task_cb (ecore_private.h:336)
==27523==    by 0x647FB8B: _ecore_timer_expired_call (ecore_timer.c:733)
==27523==    by 0x647F9EE: _ecore_timer_expired_timers_call (ecore_timer.c:686)
==27523==    by 0x647B4CE: _ecore_main_loop_iterate_internal (ecore_main.c:1814)
==27523==    by 0x647998E: ecore_main_loop_begin (ecore_main.c:983)
==27523==    by 0x4E4F676: elm_run (elm_main.c:1099)
==27523==    by 0x12801B: elm_main (test.c:1010)
==27523==    by 0x1280C4: main (test.c:1021)

@fix

diff --git a/src/lib/ecore_audio/ecore_audio_pulse_ml.c b/src/lib/ecore_audio/ecore_audio_pulse_ml.c
index 11cf118..841719b 100644 (file)
--- a/src/lib/ecore_audio/ecore_audio_pulse_ml.c
+++ b/src/lib/ecore_audio/ecore_audio_pulse_ml.c
@@ -121,15 +121,34 @@ struct pa_time_event
 
    pa_time_event_cb_t              callback;
    pa_time_event_destroy_cb_t      destroy_callback;
+   Eina_Bool in_event : 1;
+   Eina_Bool dead : 1;
 };
 
+void
+_ecore_pa_time_free(pa_time_event *event)
+{
+   event->dead = 1;
+   if (event->in_event) return;
+   if (event->timer)
+     ecore_timer_del(event->timer);
+
+   event->timer = NULL;
+
+   free(event);
+}
+
 Eina_Bool
 _ecore_time_wrapper(void *data)
 {
    pa_time_event *event = (pa_time_event *)data;
 
+   event->in_event = 1;
    event->callback(event->mainloop, event, &event->tv, event->userdata);
+   event->in_event = 0;
    event->timer = NULL;
+   if (event->dead)
+     _ecore_pa_time_free(event);
    return ECORE_CALLBACK_CANCEL;
 }
 
@@ -194,17 +213,6 @@ _ecore_pa_time_restart(pa_time_event *event, const struct timeval *tv)
 }
 
 void
-_ecore_pa_time_free(pa_time_event *event)
-{
-   if (event->timer)
-     ecore_timer_del(event->timer);
-
-   event->timer = NULL;
-
-   free(event);
-}
-
-void
 _ecore_pa_time_set_destroy(pa_time_event *event, pa_time_event_destroy_cb_t cb)
 {
    event->destroy_callback = cb;