From 70e1032094141a420cfb1a918ad4fdf42d8be7a3 Mon Sep 17 00:00:00 2001
From: Erick Tryzelaar <erick.tryzelaar@gmail.com>
Date: Sat, 17 Sep 2011 08:38:29 -0700
Subject: [PATCH] unix: Fix uv_getaddrinfo from deleting invalid data

If the uv_getaddrinfo_t handle is owned by its
data pointer, deleting the data in the callback
could cause uv_getaddrinfo_done to call freeaddrinfo
on an invalid pointer.
---
 src/unix/core.c         | 7 ++++---
 test/test-getaddrinfo.c | 8 +++++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/unix/core.c b/src/unix/core.c
index 8d7b0d05..505743b9 100644
--- a/src/unix/core.c
+++ b/src/unix/core.c
@@ -575,6 +575,8 @@ int64_t uv_timer_get_repeat(uv_timer_t* timer) {
 
 static int uv_getaddrinfo_done(eio_req* req) {
   uv_getaddrinfo_t* handle = req->data;
+  struct addrinfo *res = handle->res;
+  handle->res = NULL;
 
   uv_unref(handle->loop);
 
@@ -587,10 +589,9 @@ static int uv_getaddrinfo_done(eio_req* req) {
     uv_err_new(handle->loop, handle->retcode);
   }
 
-  handle->cb(handle, handle->retcode, handle->res);
+  handle->cb(handle, handle->retcode, res);
 
-  freeaddrinfo(handle->res);
-  handle->res = NULL;
+  freeaddrinfo(res);
 
   return 0;
 }
diff --git a/test/test-getaddrinfo.c b/test/test-getaddrinfo.c
index cac471ca..4f0514f5 100644
--- a/test/test-getaddrinfo.c
+++ b/test/test-getaddrinfo.c
@@ -31,10 +31,10 @@
 
 static const char* name = "localhost";
 
-static uv_getaddrinfo_t getaddrinfo_handle;
 static int getaddrinfo_cbs = 0;
 
 /* data used for running multiple calls concurrently */
+static uv_getaddrinfo_t* getaddrinfo_handle;
 static uv_getaddrinfo_t getaddrinfo_handles[CONCURRENT_COUNT];
 static int callback_counts[CONCURRENT_COUNT];
 
@@ -42,8 +42,9 @@ static int callback_counts[CONCURRENT_COUNT];
 static void getaddrinfo_basic_cb(uv_getaddrinfo_t* handle,
                                  int status,
                                  struct addrinfo* res) {
-  ASSERT(handle == &getaddrinfo_handle);
+  ASSERT(handle == getaddrinfo_handle);
   getaddrinfo_cbs++;
+  free(handle);
 }
 
 
@@ -71,9 +72,10 @@ static void getaddrinfo_cuncurrent_cb(uv_getaddrinfo_t* handle,
 
 TEST_IMPL(getaddrinfo_basic) {
   int r;
+  getaddrinfo_handle = (uv_getaddrinfo_t*)malloc(sizeof(uv_getaddrinfo_t));
 
   r = uv_getaddrinfo(uv_default_loop(),
-                     &getaddrinfo_handle,
+                     getaddrinfo_handle,
                      &getaddrinfo_basic_cb,
                      name,
                      NULL,