bgo #316313 / bnc #116762, and probably also bgo #318252

	* libsoup/soup-message-io.c (soup_message_io_stop): clear io->conn
	after releasing it, to make sure we can't accidentally release it
	twice.

	* libsoup/soup-connection.c (clear_current_request): Call
	soup_message_io_stop() on the cleared request.

	* libsoup/soup-connection-ntlm.c (ntlm_authorize_post): do a
	little dance here to make sure the session can't queue another
	message on the connection while we're in the process of requeuing
	the original one.

diff --git a/ChangeLog b/ChangeLog
index 81add66..da792a5 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,19 @@
+2005-10-27  Dan Winship  <danw@novell.com>
+
+       * libsoup/soup-message-io.c (soup_message_io_stop): clear io->conn
+       (and also unref it rather than leaking it like before).
+
+       * libsoup/soup-connection.c (clear_current_request): Call
+       soup_message_io_stop() on the cleared message (to ensure that its
+       priv->io->conn is cleared).
+
+       Fix bgo #316313 / bnc #116762, and maybe bgo #318252
+
+       * libsoup/soup-connection-ntlm.c (ntlm_authorize_post): do a
+       little dance here to make sure the session can't queue another
+       message on the connection while we're in the process of requeuing
+       the original one.
+
 2005-08-30  Tor Lillqvist  <tml@novell.com>
 
        * libsoup-zip.in: Include documentation in developer zipfile.

diff --git a/libsoup/soup-connection-ntlm.c b/libsoup/soup-connection-ntlm.c
index 6e284e2..4ca38ff 100644 (file)
--- a/libsoup/soup-connection-ntlm.c
+++ b/libsoup/soup-connection-ntlm.c
@@ -28,7 +28,6 @@ typedef enum {
 } SoupConnectionNTLMState;
 
 typedef struct {
-       char *user;
        guchar nt_hash[21], lm_hash[21];
        SoupConnectionNTLMState state;
 } SoupConnectionNTLMPrivate;
@@ -56,7 +55,6 @@ finalize (GObject *object)
 {
        SoupConnectionNTLMPrivate *priv = SOUP_CONNECTION_NTLM_GET_PRIVATE (object);
 
-       g_free (priv->user);
        memset (priv->nt_hash, 0, sizeof (priv->nt_hash));
        memset (priv->lm_hash, 0, sizeof (priv->lm_hash));
 
@@ -161,6 +159,16 @@ ntlm_authorize_post (SoupMessage *msg, gpointer conn)
            soup_message_get_header (msg->request_headers, "Authorization")) {
                /* We just added the last Auth header, so restart it. */
                priv->state = SOUP_CONNECTION_NTLM_SENT_RESPONSE;
+
+               /* soup_message_restarted() will call soup_message_io_stop(),
+                * which will release the connection, and may cause another
+                * message to be queued on the connection before it returns.
+                * That's no good, so we stop the message first and then
+                * reclaim the connection so that soup_message_restarted()
+                * won't be able to steal it.
+                */
+               soup_message_io_stop (msg);
+               soup_connection_reserve (conn);
                soup_message_restarted (msg);
                soup_connection_send_request (conn, msg);
        }

diff --git a/libsoup/soup-connection.c b/libsoup/soup-connection.c
index d75ec4a..1f85e37 100644 (file)
--- a/libsoup/soup-connection.c
+++ b/libsoup/soup-connection.c
@@ -355,14 +355,18 @@ clear_current_request (SoupConnection *conn)
        SoupConnectionPrivate *priv = SOUP_CONNECTION_GET_PRIVATE (conn);
 
        if (priv->cur_req) {
-               if (!soup_message_is_keepalive (priv->cur_req))
-                       soup_connection_disconnect (conn);
-               else
-                       priv->last_used = time (NULL);
+               SoupMessage *cur_req = priv->cur_req;
 
                g_object_remove_weak_pointer (G_OBJECT (priv->cur_req),
                                              (gpointer *)&priv->cur_req);
                priv->cur_req = NULL;
+
+               if (!soup_message_is_keepalive (cur_req))
+                       soup_connection_disconnect (conn);
+               else {
+                       priv->last_used = time (NULL);
+                       soup_message_io_stop (cur_req);
+               }
        }
        priv->in_use = FALSE;
 }

diff --git a/libsoup/soup-message-io.c b/libsoup/soup-message-io.c
index 427c4d4..b06d350 100644 (file)
--- a/libsoup/soup-message-io.c
+++ b/libsoup/soup-message-io.c
@@ -128,8 +128,12 @@ soup_message_io_stop (SoupMessage *msg)
 
        if (io->read_state != SOUP_MESSAGE_IO_STATE_DONE)
                soup_socket_disconnect (io->sock);
-       else if (io->conn)
-               soup_connection_release (io->conn);
+       else if (io->conn) {
+               SoupConnection *conn = io->conn;
+               io->conn = NULL;
+               soup_connection_release (conn);
+               g_object_unref (conn);
+       }
 }
 
 #define SOUP_MESSAGE_IO_EOL            "\r\n"