tevent_poll: Avoid a crash in poll_fresh_fde_destructor

The event context might have been freed before the fde

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/lib/tevent/tevent_poll.c b/lib/tevent/tevent_poll.c
index 0c580e49eec081ac842d10688cd80464cae61800..f63173744fae431cf64857b3525a99b3156f5977 100644 (file)
--- a/lib/tevent/tevent_poll.c
+++ b/lib/tevent/tevent_poll.c
@@ -218,8 +218,15 @@ done:
 
 static int poll_fresh_fde_destructor(struct tevent_fd *fde)
 {
-       struct poll_event_context *poll_ev = talloc_get_type_abort(
-               fde->event_ctx->additional_data, struct poll_event_context);
+       struct tevent_context *ev = fde->event_ctx;
+       struct poll_event_context *poll_ev;
+
+       if (ev == NULL) {
+               return 0;
+       }
+       poll_ev = talloc_get_type_abort(
+               ev->additional_data, struct poll_event_context);
+
        DLIST_REMOVE(poll_ev->fresh, fde);
        return 0;
 }