base: thread: Fix recursive calls to dispatchMessages()

There are use cases for calling the dispatchMessages() function
recursively, from within a message handler. This can be used, for
instance, to force delivery of messages posted to a thread concurrently
to stopping the thread. This currently causes access, in the outer
dispatchMessages() call, to iterators that have been invalidated by
erasing list elements in the recursive call, leading to undefined
behaviour (most likely double-free or other crashes).

Fix it by only erasing messages from the list at the end of the outer
call, identified using a recursion counter.

Bug: https://bugs.libcamera.org/show_bug.cgi?id=26
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo@jmondi.org>
Tested-by: David Plowman <david.plowman@raspberrypi.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>

0 files changed, 0 insertions, 0 deletions