From 06dbca681a76e32927648a28ad644a41d4b150f6 Mon Sep 17 00:00:00 2001
From: Art Cancro <ajc@uncensored.citadel.org>
Date: Fri, 15 Jul 2011 14:46:41 -0400
Subject: [PATCH] Attempting to fix a segfault generated in Removecontext()

---
 citadel/context.c                | 17 +++++++++--------
 citadel/modules/wiki/serv_wiki.c | 12 +++++++++---
 citadel/msgbase.c                | 28 +++++++++++++++-------------
 3 files changed, 33 insertions(+), 24 deletions(-)

diff --git a/citadel/context.c b/citadel/context.c
index 95bdc46f1..181d0347c 100644
--- a/citadel/context.c
+++ b/citadel/context.c
@@ -338,15 +338,16 @@ void terminate_all_sessions(void)
 void RemoveContext (CitContext *con)
 {
 	const char *c;
-	if (con==NULL) {
-		syslog(LOG_ERR, "WARNING: RemoveContext() called with NULL!\n");
+	if (con == NULL) {
+		syslog(LOG_ERR, "WARNING: RemoveContext() called with NULL!");
 		return;
 	}
 	c = con->ServiceName;
-	if (c == NULL)
+	if (c == NULL) {
 		c = "WTF?";
-	syslog(LOG_DEBUG, "RemoveContext(%s) session %d\n", c, con->cs_pid);
-	cit_backtrace ();
+	}
+	syslog(LOG_DEBUG, "RemoveContext(%s) session %d", c, con->cs_pid);
+	cit_backtrace();
 
 	/* Run any cleanup routines registered by loadable modules.
 	 * Note: We have to "become_session()" because the cleanup functions
@@ -358,7 +359,7 @@ void RemoveContext (CitContext *con)
 	client_close();				/* If the client is still connected, blow 'em away. */
 	become_session(NULL);
 
-	syslog(LOG_NOTICE, "[%3d] Session ended.\n", con->cs_pid);
+	syslog(LOG_NOTICE, "[%3d] Session ended.", con->cs_pid);
 
 	/* 
 	 * If the client is still connected, blow 'em away. 
@@ -366,7 +367,7 @@ void RemoveContext (CitContext *con)
 	 */
 	if (con->client_socket > 0)
 	{
-		syslog(LOG_NOTICE, "Closing socket %d\n", con->client_socket);
+		syslog(LOG_NOTICE, "Closing socket %d", con->client_socket);
 		close(con->client_socket);
 	}
 
@@ -382,7 +383,7 @@ void RemoveContext (CitContext *con)
 		free(con->cached_msglist);
 	}
 
-	syslog(LOG_DEBUG, "Done with RemoveContext()\n");
+	syslog(LOG_DEBUG, "Done with RemoveContext()");
 }
 
 
diff --git a/citadel/modules/wiki/serv_wiki.c b/citadel/modules/wiki/serv_wiki.c
index 77f7899f1..242f52d04 100644
--- a/citadel/modules/wiki/serv_wiki.c
+++ b/citadel/modules/wiki/serv_wiki.c
@@ -610,10 +610,16 @@ void wiki_rev(char *pagename, char *rev, char *operation)
 			 * but only if the client fetches the message we just generated immediately
 			 * without first trying to perform other fetch operations.
 			 */
-			if (CC->cached_msglist != NULL) free(CC->cached_msglist);
-			CC->cached_num_msgs = 1;
+			if (CC->cached_msglist != NULL) {
+				free(CC->cached_msglist);
+				CC->cached_msglist = NULL;
+				CC->cached_num_msgs = 0;
+			}
 			CC->cached_msglist = malloc(sizeof(long));
-			CC->cached_msglist[0] = msgnum;
+			if (CC->cached_msglist != NULL) {
+				CC->cached_num_msgs = 1;
+				CC->cached_msglist[0] = msgnum;
+			}
 
 		}
 		else if (!strcasecmp(operation, "revert")) {
diff --git a/citadel/msgbase.c b/citadel/msgbase.c
index 304023bc6..c252f5ff0 100644
--- a/citadel/msgbase.c
+++ b/citadel/msgbase.c
@@ -644,18 +644,6 @@ int CtdlForEachMessage(int mode, long ref, char *search_string,
 	cdbfr->ptr = NULL;	/* clear this so that cdb_free() doesn't free it */
 	cdb_free(cdbfr);	/* we own this memory now */
 
-	/*
-	 * We cache the most recent msglist in order to do security checks later
-	 */
-	if (CC->client_socket > 0) {
-		if (CC->cached_msglist != NULL) {
-			free(CC->cached_msglist);
-		}
-	
-		CC->cached_msglist = msglist;
-		CC->cached_num_msgs = num_msgs;
-	}
-
 	/*
 	 * Now begin the traversal.
 	 */
@@ -787,7 +775,21 @@ int CtdlForEachMessage(int mode, long ref, char *search_string,
 			}
 		}
 	if (need_to_free_re) regfree(&re);
-	if (CC->client_socket <= 0) free(msglist);
+
+	/*
+	 * We cache the most recent msglist in order to do security checks later
+	 */
+	if (CC->client_socket > 0) {
+		if (CC->cached_msglist != NULL) {
+			free(CC->cached_msglist);
+		}
+		CC->cached_msglist = msglist;
+		CC->cached_num_msgs = num_msgs;
+	}
+	else {
+		free(msglist);
+	}
+
 	return num_processed;
 }
 
-- 
2.30.2