From 3d6739eaa6e1b56d67bc7d9b5350a6911c96597a Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Mon, 22 Aug 2005 01:51:02 +0000
Subject: [PATCH] r9464: fixed a problem with child pointers copied into
 non-allocated mpr variables. We now use the same free technique as is used
 for mpr strings, rather than relying on being a child of the variable

---
 source/lib/appweb/mpr/var.c    | 14 +++++++++++++-
 source/scripting/ejs/mprutil.c |  6 ++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/source/lib/appweb/mpr/var.c b/source/lib/appweb/mpr/var.c
index 77f4cbc55a3..09979156e89 100644
--- a/source/lib/appweb/mpr/var.c
+++ b/source/lib/appweb/mpr/var.c
@@ -181,6 +181,13 @@ static bool freeVarStorage(MprVar *vp, int force)
 		}
 		break;
 
+	case MPR_TYPE_PTR:
+		if (vp->allocatedData) {
+			vp->allocatedData = 0;
+			mprFree(vp->ptr);
+		}
+		break;
+
 	case MPR_TYPE_OBJECT:
 #if VAR_DEBUG
 		/*
@@ -1418,7 +1425,12 @@ static void copyVarCore(MprVar *dest, MprVar *src, int copyDepth)
 	case MPR_TYPE_PTR:
 		/* we have to reference here so talloc structures survive a
 		   copy */
-		dest->ptr = talloc_reference(dest, src->ptr);
+		if (src->allocatedData) {
+			dest->ptr = talloc_reference(mprMemCtx(), src->ptr);
+			dest->allocatedData = 1;
+		} else {
+			dest->ptr = src->ptr;
+		}
 		break;
 
 	case MPR_TYPE_STRING_CFUNCTION:
diff --git a/source/scripting/ejs/mprutil.c b/source/scripting/ejs/mprutil.c
index 8f1e5f71c87..38cfd2c4934 100644
--- a/source/scripting/ejs/mprutil.c
+++ b/source/scripting/ejs/mprutil.c
@@ -369,12 +369,14 @@ void mprSetPtr(struct MprVar *v, const char *propname, const void *p)
 }
 
 /*
-  set a pointer in a existing MprVar, making it a child of the property
+  set a pointer in a existing MprVar, freeing it when the property goes away
 */
 void mprSetPtrChild(struct MprVar *v, const char *propname, const void *p)
 {
 	mprSetVar(v, propname, mprCreatePtrVar(discard_const(p)));
-	talloc_steal(mprGetProperty(v, propname, NULL), p);
+	v = mprGetProperty(v, propname, NULL);
+	v->allocatedData = 1;
+	talloc_steal(mprMemCtx(), p);
 }
 
 /*