commit 0243d46224c840952de3ffe7830b1b5ae0557f64 parent 19d6bd8f06f8dbc051a78daba4acbe66fdc58fdd Author: Christian Grothoff <christian@grothoff.org> Date: Mon, 13 Jul 2026 00:02:29 +0200 maintain exchange_inquiries counter properly Diffstat:
| M | src/backend/taler-merchant-reconciliation.c | | | 15 | +++++++++++++++ |
1 file changed, 15 insertions(+), 0 deletions(-)
diff --git a/src/backend/taler-merchant-reconciliation.c b/src/backend/taler-merchant-reconciliation.c @@ -419,10 +419,24 @@ end_inquiry (struct Inquiry *w) GNUNET_assert (active_inquiries > 0); active_inquiries--; + /* The exchange-request slot (e->exchange_inquiries) is taken when the + exchange_request task is scheduled (w->task) and held until either that + task fails to create the request or the request completes. Reclaim it + here for whichever of the (mutually exclusive) states is active, and + cancel a still-queued task to avoid a use-after-free on the freed w. */ + if (NULL != w->task) + { + GNUNET_SCHEDULER_cancel (w->task); + w->task = NULL; + GNUNET_assert (e->exchange_inquiries > 0); + e->exchange_inquiries--; + } if (NULL != w->wdh) { TALER_EXCHANGE_get_transfers_cancel (w->wdh); w->wdh = NULL; + GNUNET_assert (e->exchange_inquiries > 0); + e->exchange_inquiries--; } GNUNET_free (w->instance_id); GNUNET_free (w->payto_uri.full_payto); @@ -735,6 +749,7 @@ wire_transfer_cb (struct Inquiry *w, struct Exchange *e = w->exchange; const struct TALER_EXCHANGE_TransferData *td = NULL; + GNUNET_assert (e->exchange_inquiries > 0); e->exchange_inquiries--; w->wdh = NULL; if (EXCHANGE_INQUIRY_LIMIT - 1 == e->exchange_inquiries)