Bug Summary

File:libtrivfs/protid-clean.c
Location:line 45, column 26
Description:Use of memory after it is freed

Annotated Source Code

1/*
2 Copyright (C) 1994, 1995, 1996 Free Software Foundation
3
4 This program is free software; you can redistribute it and/or
5 modify it under the terms of the GNU General Public License as
6 published by the Free Software Foundation; either version 2, or (at
7 your option) any later version.
8
9 This program is distributed in the hope that it will be useful, but
10 WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 General Public License for more details.
13
14 You should have received a copy of the GNU General Public License
15 along with this program; if not, write to the Free Software
16 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
17
18#include "priv.h"
19
20/* Clean pointers in a struct trivfs_protid when its last reference vanishes
21 before it's freed. */
22void
23trivfs_clean_protid (void *arg)
24{
25 struct trivfs_protid *cred = arg;
26
27 if (trivfs_protid_destroy_hook && cred->realnode != MACH_PORT_NULL((mach_port_t) 0))
28 /* Allow the user to clean up; If the realnode field is null, then CRED
29 wasn't initialized to the point of needing user cleanup. */
30 (*trivfs_protid_destroy_hook) (cred);
31
32 /* If we hold the only reference to the peropen, try to get rid of it. */
33 pthread_mutex_lock (&cred->po->cntl->lock);
34 if (cred->po->refcnt == 1 && trivfs_peropen_destroy_hook)
1
Taking false branch
35 {
36 pthread_mutex_unlock (&cred->po->cntl->lock);
37 (*trivfs_peropen_destroy_hook) (cred->po);
38 pthread_mutex_lock (&cred->po->cntl->lock);
39 }
40 if (--cred->po->refcnt == 0)
2
Taking true branch
41 {
42 ports_port_deref (cred->po->cntl);
43 free (cred->po);
3
Memory is released
44 }
45 pthread_mutex_unlock (&cred->po->cntl->lock);
4
Use of memory after it is freed
46
47 iohelp_free_iouser (cred->user);
48
49 if (cred->realnode != MACH_PORT_NULL((mach_port_t) 0))
50 mach_port_deallocate (mach_task_self ()((__mach_task_self_ + 0)), cred->realnode);
51}
52
53
54