From 8ee294a412785e17733db2e016e0489d9daf29bc Mon Sep 17 00:00:00 2001
From: Learath Lea <learath2@gmail.com>
Date: Fri, 27 Feb 2015 23:06:19 +0200
Subject: [PATCH] Fix use after free. Fix thread launching.

---
 src/engine/client/fetcher.cpp | 17 ++++++++++++-----
 src/engine/client/fetcher.h   |  2 ++
 src/engine/fetcher.h          |  1 +
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/engine/client/fetcher.cpp b/src/engine/client/fetcher.cpp
index 324582e8c..89c7b31a1 100644
--- a/src/engine/client/fetcher.cpp
+++ b/src/engine/client/fetcher.cpp
@@ -43,10 +43,14 @@ void CFetcher::QueueAdd(CFetchTask *pTask, const char *pUrl, const char *pDest,
 	pTask->m_Abort = false;
 
 	lock_wait(m_Lock);
+	if(!m_pThHandle)
+	{
+		m_pThHandle = thread_create(&FetcherThread, this);
+		thread_detach(m_pThHandle);
+	}
+
 	if(!m_pFirst)
 	{
-		void *pHandle = thread_create(&FetcherThread, this);
-		thread_detach(pHandle);
 		m_pFirst = pTask;
 		m_pLast = m_pFirst;
 	}
@@ -99,7 +103,10 @@ bool CFetcher::FetchFile(CFetchTask *pTask)
 		}
 	}
 
-	IOHANDLE File = m_pStorage->OpenFile(pTask->m_pDest, IOFLAG_WRITE, pTask->m_StorageType);
+	char aPath[256];
+	m_pStorage->GetCompletePath(pTask->m_StorageType, pTask->m_pDest, aPath, sizeof(aPath));
+	IOHANDLE File = io_open(aPath, IOFLAG_WRITE);
+
 
 	char aErr[CURL_ERROR_SIZE];
 	curl_easy_setopt(m_pHandle, CURLOPT_ERRORBUFFER, aErr);
@@ -126,10 +133,10 @@ bool CFetcher::FetchFile(CFetchTask *pTask)
 		return false;
 	}
 	io_close(File);
+	dbg_msg("fetcher", "Task done %s", pTask->m_pDest);
+	pTask->m_State = CFetchTask::STATE_DONE;	
 	if(pTask->m_pfnCompCallback)
 		pTask->m_pfnCompCallback(pTask, pTask->m_pUser);
-	dbg_msg("fetcher", "Task done %s", pTask->m_pDest);
-	pTask->m_State = CFetchTask::STATE_DONE;
 	return true;
 }
 
diff --git a/src/engine/client/fetcher.h b/src/engine/client/fetcher.h
index 0b0f73b98..7803f5ea5 100644
--- a/src/engine/client/fetcher.h
+++ b/src/engine/client/fetcher.h
@@ -11,6 +11,8 @@ class CFetcher : public IFetcher
 private:
 	CURL *m_pHandle;
 
+	void *m_pThHandle;
+
 	LOCK m_Lock;
 	CFetchTask *m_pFirst;
 	CFetchTask *m_pLast;
diff --git a/src/engine/fetcher.h b/src/engine/fetcher.h
index 6a39ca4cf..c6de82f59 100644
--- a/src/engine/fetcher.h
+++ b/src/engine/fetcher.h
@@ -2,6 +2,7 @@
 #define ENGINE_FETCHER_H
 
 #include "kernel.h"
+#include "stddef.h"
 
 class CFetchTask;