httpd_output: check client->write_source_id in handler

Due to a race condition, httpd_client_out_event() could be called even
when its GLib event source was already removed.  Check that case.

1 files changed, 7 insertions, 0 deletions

diff --git a/src/output/httpd_client.c b/src/output/httpd_client.c
index 6f87b972..266a207c 100644
--- a/src/output/httpd_client.c
+++ b/src/output/httpd_client.c
@@ -459,6 +459,13 @@ httpd_client_out_event(GIOChannel *source,
 	assert(condition == G_IO_OUT);
 	assert(client->state == RESPONSE);
 
+	if (client->write_source_id == 0) {
+		/* another thread has removed the event source while
+		   this thread was waiting for httpd->mutex */
+		g_mutex_unlock(httpd->mutex);
+		return false;
+	}
+
 	if (client->current_page == NULL) {
 		client->current_page = g_queue_pop_head(client->pages);
 		client->current_position = 0;