Comment 1 for bug 1481388

Revision history for this message
Eric Desrochers (slashd) wrote :

The remove_ and delete_ functions remove the current element from the asyncio_reader_list, and free it, respectively.

We then return back to the loop at the top, wherein the asyncio_reader variable still points at the now-freed element,
whose contents are now scrambled by having link pointers, etc, from internal malloc state overlaying the data.

This loop should probably extract the ->link pointer prior to calling ->receiver(), as that function can free the asyncio_reader object in question. (LP: #1481388)