# HG changeset patch
# User Mark Doliner <mark@kingant.net>
# Date 1270547547 0
# Node ID 6797736dbe371ba63d86af21000fce86e485b1ec
# Parent  c726b1461159fdb6d93356d6b3c43134b8b27745
Does anyone know the purpose of the ui_write, ui_read and data_not_sent
FT UI callbacks?  It looks like they allow a UI to decide how to safe
incoming file transfers?  They're not used in Pidgin or Finch.  Are
they used elsewhere?

Valgrind is complaining about an invalid free.  I think it happens either
when the local user cancels a file transfer or when the remote user
cancels a file transfer.  I think this change fixes it.

Revision fa4ce539e5025eb07aad3ca824cd4c512010d8a8 is related to these
callbacks and to this change by foufou33@ gee male dot com

The valgrind error is:
==23064== Invalid free() / delete / delete[]
==23064==    at 0x4C24D68: free (vg_replace_malloc.c:325)
==23064==    by 0x9293209: g_array_free (in /lib/libglib-2.0.so.0.2200.3)
==23064==    by 0x95B1995: purple_xfer_priv_data_destroy (ft.c:71)
==23064==    by 0x92AA5D1: ??? (in /lib/libglib-2.0.so.0.2200.3)
==23064==    by 0x92AAE17: g_hash_table_remove_all (in /lib/libglib-2.0.so.0.2200.3)
==23064==    by 0x92AAFC4: g_hash_table_destroy (in /lib/libglib-2.0.so.0.2200.3)
==23064==    by 0x95B579C: purple_xfers_uninit (ft.c:1642)
==23064==    by 0x95ACF08: purple_core_quit (core.c:238)
==23064==    by 0x43EB3E: gtk_blist_delete_cb (gtkblist.c:227)
==23064==    by 0x6F9A727: ??? (in /usr/lib/libgtk-x11-2.0.so.0.1800.3)
==23064==  Address 0x2355f0e0 is not stack'd, malloc'd or (recently) free'd

diff -r c726b1461159 -r 6797736dbe37 libpurple/ft.c
--- a/libpurple/ft.c	Tue Apr 06 09:26:30 2010 +0000
+++ b/libpurple/ft.c	Tue Apr 06 09:52:27 2010 +0000
@@ -57,6 +57,8 @@
 		PURPLE_XFER_READY_UI   = 0x1,
 		PURPLE_XFER_READY_PRPL = 0x2,
 	} ready;
+
+	/* TODO: Should really use a PurpleCircBuffer for this. */
 	GByteArray *buffer;
 } PurpleXferPrivData;
 
@@ -1147,7 +1149,7 @@
 		}
 
 		if (priv->buffer) {
-			priv->buffer = g_byte_array_append(priv->buffer, buffer, result);
+			g_byte_array_append(priv->buffer, buffer, result);
 			g_free(buffer);
 			buffer = priv->buffer->data;
 			result = priv->buffer->len;
@@ -1157,7 +1159,10 @@
 
 		if (r == -1) {
 			purple_xfer_cancel_remote(xfer);
-			g_free(buffer);
+			if (!priv->buffer)
+				/* We don't free buffer if priv->buffer is set, because in
+				   that case buffer doesn't belong to us. */
+				g_free(buffer);
 			return;
 		} else if (r == result) {
 			/*
@@ -1175,10 +1180,10 @@
 			/*
 			 * Remove what we wrote
 			 * If we wrote the whole buffer the byte array will be empty
-			 * Otherwise we'll kee what wasn't sent for next time.
+			 * Otherwise we'll keep what wasn't sent for next time.
 			 */
 			buffer = NULL;
-			priv->buffer = g_byte_array_remove_range(priv->buffer, 0, r);
+			g_byte_array_remove_range(priv->buffer, 0, r);
 		}
 	}