On Fri, 2011-12-16 at 10:31 +0100, Jakub Hrozek wrote:
I noticed that sss_dp_get_account_int_done() would free sdp_req but
the callback destructor would dereference sdp_req as well. When the
destructor is called, sdp_req is already gone.
It looks that the callback is not needed after it has called the request
it links to so I think we can just free it and let the destructor
remove it from the list.
It took me a while to puzzle out what the problem was here. The issue is
that the sdp_req is always freed just after the callbacks with the
results are sent back. However, the callback contexts are not allocated
beneath the sdp_req (because they need to be cancellable if the client
disconnects). So what would happen is that they would hang around until
the client eventually freed them, which would always happen *after* the
sdp_req had been freed.
This has been working only because we were lucky and the memory for
sdp_req was not being reclaimed.
Ack (and good catch!)