Linux: fix libevent bug.

third_party/libevent/epoll.c

 /*
  * Copyright 2000-2003 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 153 matching lines @@
 static int
 epoll_recalc(struct event_base *base, void *arg, int max)
 {
         struct epollop *epollop = arg;
 
         if (max >= epollop->nfds) {
                 struct evepoll *fds;
                 int nfds;
 
                 nfds = epollop->nfds;
-                while (nfds < max)
+                while (nfds <= max)

[agl, 2009/06/02 23:18:14]

|max| is an index into fds which needs to be valid. If |max| == |nfds| then
|fds| is still too short, but won't be resized.

                         nfds <<= 1;
 
                 fds = realloc(epollop->fds, nfds * sizeof(struct evepoll));
                 if (fds == NULL) {
                         event_warn("realloc");
                         return (-1);
                 }
                 epollop->fds = fds;
                 memset(fds + epollop->nfds, 0,
                     (nfds - epollop->nfds) * sizeof(struct evepoll));
@@ skipping 179 matching lines @@
         if (epollop->fds)
                 free(epollop->fds);
         if (epollop->events)
                 free(epollop->events);
         if (epollop->epfd >= 0)
                 close(epollop->epfd);
 
         memset(epollop, 0, sizeof(struct epollop));
         free(epollop);
 }