From: Jean-Philippe Andre <jp.andre@samsung.com>
Date: Mon, 9 Dec 2013 08:48:32 +0000 (+0900)
Subject: Evas/cserve2: Fix crash during shutdown
X-Git-Tag: v1.9.0-alpha1~478
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=b10dcb5c2366c135bbae014d084b07f039b34fde;p=platform%2Fupstream%2Fefl.git

Evas/cserve2: Fix crash during shutdown

If an image failed to load, and cserve2 returned an error message,
then the File_Entry was freed, but not removed from the hash.
Solution: remove entry from the hash, let the callback free the data.
---

diff --git a/src/lib/evas/cserve2/evas_cs2_client.c b/src/lib/evas/cserve2/evas_cs2_client.c
index c5ef594..c65003f 100644
--- a/src/lib/evas/cserve2/evas_cs2_client.c
+++ b/src/lib/evas/cserve2/evas_cs2_client.c
@@ -690,8 +690,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
      }
    ie->open_rid = 0;
 
-   if (answer->type != CSERVE2_OPENED)
+   if ((answer->type != CSERVE2_OPENED) || (size < (int) sizeof(*msg)))
      {
+        File_Entry *fentry = ie->data1;
         if (answer->type == CSERVE2_ERROR)
           {
              const Msg_Error *msg_error = msg_received;
@@ -700,15 +701,9 @@ _image_opened_cb(void *data, const void *msg_received, int size)
           }
         else
           ERR("Invalid message type received: %d (%s)", answer->type, __FUNCTION__);
-        free(ie->data1);
-        ie->data1 = NULL;
-        return EINA_TRUE;
-     }
-   else if (size < (int) sizeof(*msg))
-     {
-        ERR("Received message is too small");
-        free(ie->data1);
-        ie->data1 = NULL;
+        fentry = ie->data1;
+        EINA_REFCOUNT_UNREF(fentry)
+          eina_hash_del(_file_entries, fentry->hkey, fentry);
         return EINA_TRUE;
      }