Found a place where CM_SetAsField() was owning db memory.

Changed that, of course.  It was causing a double free.

diff --git a/citadel/server/internet_addressing.c b/citadel/server/internet_addressing.c
index e2bdd6ecf00379eac9581001f31c2eab4b2f1aa2..4108b41f12598333ba234751ece925317447a8b6 100644 (file)
--- a/citadel/server/internet_addressing.c
+++ b/citadel/server/internet_addressing.c
@@ -1006,8 +1006,7 @@ struct CtdlMessage *convert_internet_message(char *rfc822) {
 }
 
 
-struct CtdlMessage *convert_internet_message_buf(StrBuf **rfc822)
-{
+struct CtdlMessage *convert_internet_message_buf(StrBuf **rfc822) {
        struct CtdlMessage *msg;
        const char *pos, *beg, *end, *totalend;
        int done, alldone = 0;
@@ -1034,26 +1033,18 @@ struct CtdlMessage *convert_internet_message_buf(StrBuf **rfc822)
                 */
                end = beg = pos;
 
-               while ((end < totalend) && 
-                      (end == beg) && 
-                      (done == 0) ) 
-               {
+               while ((end < totalend) && (end == beg) && (done == 0) ) {
 
-                       if ( (*pos=='\n') && ((*(pos+1))!=0x20) && ((*(pos+1))!=0x09) )
-                       {
+                       if ( (*pos=='\n') && ((*(pos+1))!=0x20) && ((*(pos+1))!=0x09) ) {
                                end = pos;
                        }
 
                        /* done with headers? */
-                       if ((*pos=='\n') &&
-                           ( (*(pos+1)=='\n') ||
-                             (*(pos+1)=='\r')) ) 
-                       {
+                       if ((*pos=='\n') && ( (*(pos+1)=='\n') || (*(pos+1)=='\r')) ) {
                                alldone = 1;
                        }
 
-                       if (pos >= (totalend - 1) )
-                       {
+                       if (pos >= (totalend - 1) ) {
                                end = pos;
                                done = 1;
                        }

diff --git a/citadel/server/modules/wiki/serv_wiki.c b/citadel/server/modules/wiki/serv_wiki.c
index d7d579742c08be9de86f9b2edd59fbd07c917898..bf18afd485573fd2a809e41047de076dbc2c577c 100644 (file)
--- a/citadel/server/modules/wiki/serv_wiki.c
+++ b/citadel/server/modules/wiki/serv_wiki.c
@@ -332,8 +332,7 @@ int wiki_upload_beforesave(struct CtdlMessage *msg, struct recptypes *recp) {
                        free(MsgText);
                        CM_SetAsFieldSB(history_msg, eMesageText, &NewMsgText); 
                }
-               else
-               {
+               else {
                        CM_SetAsField(history_msg, eMesageText, &MsgText, MsgTextLen); 
                }
 

diff --git a/citadel/server/msgbase.c b/citadel/server/msgbase.c
index 7ed1b8c36541d7bd9ef3358971468685e72417fb..22d9d84c5d836eb2934d9d930e059a70cf02e057 100644 (file)
--- a/citadel/server/msgbase.c
+++ b/citadel/server/msgbase.c
@@ -229,7 +229,7 @@ void CM_PrependToField(struct CtdlMessage *Msg, eMsgField which, const char *buf
 }
 
 
-// wtf?
+// This is like CM_SetField() except the caller is transferring ownership of the supplied memory to the message
 void CM_SetAsField(struct CtdlMessage *Msg, eMsgField which, char **buf, long length) {
        if (Msg->cm_fields[which] != NULL) {
                free (Msg->cm_fields[which]);
@@ -1122,7 +1122,7 @@ struct CtdlMessage *CtdlFetchMessage(long msgnum, int with_body) {
        if ( (CM_IsEmpty(ret, eMesageText)) && (with_body) ) {
                dmsgtext = cdb_fetch(CDB_BIGMSGS, &msgnum, sizeof(long));
                if (dmsgtext.ptr != NULL) {
-                       CM_SetAsField(ret, eMesageText, &dmsgtext.ptr, dmsgtext.len - 1);
+                       CM_SetField(ret, eMesageText, dmsgtext.ptr);
                }
        }
        if (CM_IsEmpty(ret, eMesageText)) {

diff --git a/citadel/utils/loadtest.c b/citadel/utils/loadtest.c
index dff616940e7d9281860273f29a9d40979eba740f..c9cfba56d8bad074e2ea5c7af26f1332096d1d46 100644 (file)
--- a/citadel/utils/loadtest.c
+++ b/citadel/utils/loadtest.c
@@ -229,7 +229,7 @@ void perform_random_thing(void) {
                serv_gets(buf);
                if (buf[0] == '4') {
 
-                       bigness = random() % 10;
+                       bigness = random() % 500;
                        strcpy(buf, "");
                        for (i=0; i<bigness; ++i) {
                                strcat(buf, words[random() % nwords]);