Comment 11 for bug 545755

Revision history for this message
In , Tim (tim-redhat-bugs) wrote :

I've discovered the reason for this, and have confirmed that the upstream fix is correct.

First, a reproducer:

==>
import signal
import cups

def alarmclock (signum, frame):
    raise KeyboardInterrupt

signal.signal (signal.SIGALRM, alarmclock)
connections = []
while True:
    # Create
    signal.alarm (10)
    connections.append (cups.Connection ())
    signal.alarm (0)
<==

This just keeps creating more and more connections until cupsd stops accepting them (when it hits its maximum file descriptor count). At that point, the program raises an exception and exits.

What happens is that Connection_init() fails *before* the newly-allocated Connection object is added into the list. As the initialization failed, the object is deallocated with Connection_dealloc(), and of course that assumes the object is in the list.

So the correct behaviour is to verify that the connection is in the list before trying to remove it.