comparison libpurple/protocols/msn/slplink.c @ 30089:287fc4ac2bd9

Add and remove an extra ref per MsnMessage when saving it in a slpmsg, to fix a possible use-after-free from valgrind. Also, don't traverse slpmsg->msgs twice.

30088:e432507151d1

#ifdef MSN_DEBUG_SLP_FILES
	debug_msg_to_file(msg, TRUE);
#endif

	slpmsg->msgs =
		g_list_append(slpmsg->msgs, msg);
	msn_slplink_send_msg(slplink, msg);

	if ((slpmsg->flags == 0x20 || slpmsg->flags == 0x1000020 ||
	     slpmsg->flags == 0x1000030) &&
		(slpmsg->slpcall != NULL))

					slpmsg->slpcall->cb(slpmsg->slpcall,
						NULL, 0);
			}
		}
	}
}

/* We have received the message nak. */
static void
msg_nak(MsnMessage *msg, void *data)

	slpmsg = data;

	msn_slplink_send_msgpart(slpmsg->slplink, slpmsg);

	slpmsg->msgs = g_list_remove(slpmsg->msgs, msg);
}

static void
msn_slplink_release_slpmsg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg)
{

30089:287fc4ac2bd9

#ifdef MSN_DEBUG_SLP_FILES
	debug_msg_to_file(msg, TRUE);
#endif

	slpmsg->msgs =
		g_list_append(slpmsg->msgs, msn_message_ref(msg));
	msn_slplink_send_msg(slplink, msg);

	if ((slpmsg->flags == 0x20 || slpmsg->flags == 0x1000020 ||
	     slpmsg->flags == 0x1000030) &&
		(slpmsg->slpcall != NULL))

					slpmsg->slpcall->cb(slpmsg->slpcall,
						NULL, 0);
			}
		}
	}

	msn_message_unref(msg);
}

/* We have received the message nak. */
static void
msg_nak(MsnMessage *msg, void *data)

	slpmsg = data;

	msn_slplink_send_msgpart(slpmsg->slplink, slpmsg);

	slpmsg->msgs = g_list_remove(slpmsg->msgs, msg);
	msn_message_unref(msg);
}

static void
msn_slplink_release_slpmsg(MsnSlpLink *slplink, MsnSlpMessage *slpmsg)
{