tal: don't access freed memory on unusual case of redundant tal_free() in destructor.

[ccan] / ccan / tal / tal.c

diff --git a/ccan/tal/tal.c b/ccan/tal/tal.c
index 177e06f4c71301be66737e298be5c9d51c826afa..0e3c97b390003dfbae3ad82687ce3f35c5d52ce0 100644 (file)
--- a/ccan/tal/tal.c
+++ b/ccan/tal/tal.c
@@ -502,6 +502,8 @@ void *tal_free(const tal_t *ctx)
                struct tal_hdr *t;
                int saved_errno = errno;
                t = debug_tal(to_tal_hdr(ctx));
+               if (unlikely(get_destroying_bit(t->parent_child)))
+                       return NULL;
                if (notifiers)
                        notify(ignore_destroying_bit(t->parent_child)->parent,
                               TAL_NOTIFY_DEL_CHILD, ctx, saved_errno);