1 files changed, 21 insertions, 20 deletions

diff --git a/linden/indra/llmessage/llassetstorage.cpp b/linden/indra/llmessage/llassetstorage.cpp
index fa14a2b..2d85011 100644
--- a/linden/indra/llmessage/llassetstorage.cpp
+++ b/linden/indra/llmessage/llassetstorage.cpp
@@ -522,16 +522,19 @@ void LLAssetStorage::downloadCompleteCallback(
         S32 result,
         const LLUUID& file_id,
         LLAssetType::EType file_type,
-        void* user_data, LLExtStat ext_status)
+        void* callback_parm_req, LLExtStat ext_status)
 {
         lldebugs << "LLAssetStorage::downloadCompleteCallback() for " << file_id
                  << "," << LLAssetType::lookup(file_type) << llendl;
-        LLAssetRequest* req = (LLAssetRequest*)user_data;
+
+        // be careful! req may be a ptr to memory already freed (a timeout does this)
+        LLAssetRequest* req = (LLAssetRequest*)callback_parm_req;       
         if(!req)
         {
                 llwarns << "LLAssetStorage::downloadCompleteCallback called without"
                         "a valid request." << llendl;
-                return;
+                // we can live with a null pointer, we're not allowed to deref the ptr anyway (see above)
+                // return;  
         }
         if (!gAssetStorage)
         {
@@ -539,12 +542,10 @@ void LLAssetStorage::downloadCompleteCallback(
                 return;
         }
 
-        req->setUUID(file_id);
-        req->setType(file_type);
         if (LL_ERR_NOERR == result)
         {
                 // we might have gotten a zero-size file
-                LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getType());
+                LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
                 if (vfile.getSize() <= 0)
                 {
                         llwarns << "downloadCompleteCallback has non-existent or zero-size asset " << req->getUUID() << llendl;
@@ -563,7 +564,7 @@ void LLAssetStorage::downloadCompleteCallback(
         {
                 request_list_t::iterator curiter = iter++;
                 LLAssetRequest* tmp = *curiter;
-                if ((tmp->getUUID() == req->getUUID()) && (tmp->getType()== req->getType()))
+                if ((tmp->getUUID() == file_id) && (tmp->getType() == file_type))
                 {
                         requests.push_front(tmp);
                         iter = gAssetStorage->mPendingDownloads.erase(curiter);
@@ -576,7 +577,7 @@ void LLAssetStorage::downloadCompleteCallback(
                 LLAssetRequest* tmp = *curiter;
                 if (tmp->mDownCallback)
                 {
-                        tmp->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getType(), tmp->mUserData, result, ext_status);
+                        tmp->mDownCallback(gAssetStorage->mVFS, tmp->getUUID(), tmp->getType(), tmp->mUserData, result, ext_status);
                 }
                 delete tmp;
         }
@@ -672,10 +673,10 @@ void LLAssetStorage::downloadEstateAssetCompleteCallback(
         S32 result,
         const LLUUID& file_id,
         LLAssetType::EType file_type,
-        void* user_data,
+        void* callback_parm_req,
         LLExtStat ext_status)
 {
-        LLEstateAssetRequest *req = (LLEstateAssetRequest*)user_data;
+        LLEstateAssetRequest *req = (LLEstateAssetRequest*)callback_parm_req;
         if(!req)
         {
                 llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
@@ -689,12 +690,10 @@ void LLAssetStorage::downloadEstateAssetCompleteCallback(
                 return;
         }
 
-        req->setUUID(file_id);
-        req->setType(file_type);
         if (LL_ERR_NOERR == result)
         {
                 // we might have gotten a zero-size file
-                LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getAType());
+                LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
                 if (vfile.getSize() <= 0)
                 {
                         llwarns << "downloadCompleteCallback has non-existent or zero-size asset!" << llendl;
@@ -704,7 +703,9 @@ void LLAssetStorage::downloadEstateAssetCompleteCallback(
                 }
         }
 
-        req->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getAType(), req->mUserData, result, ext_status);
+        req->mDownCallback(gAssetStorage->mVFS, file_id, file_type, req->mUserData, result, ext_status);
+
+        delete req;
 }
 
 void LLAssetStorage::getInvItemAsset(const LLHost &object_sim, const LLUUID &agent_id, const LLUUID &session_id,
@@ -809,10 +810,10 @@ void LLAssetStorage::downloadInvItemCompleteCallback(
         S32 result,
         const LLUUID& file_id,
         LLAssetType::EType file_type,
-        void* user_data,
+        void* callback_parm_req,
         LLExtStat ext_status)
 {
-        LLInvItemRequest *req = (LLInvItemRequest*)user_data;
+        LLInvItemRequest *req = (LLInvItemRequest*)callback_parm_req;
         if(!req)
         {
                 llwarns << "LLAssetStorage::downloadEstateAssetCompleteCallback called"
@@ -825,12 +826,10 @@ void LLAssetStorage::downloadInvItemCompleteCallback(
                 return;
         }
 
-        req->setUUID(file_id);
-        req->setType(file_type);
         if (LL_ERR_NOERR == result)
         {
                 // we might have gotten a zero-size file
-                LLVFile vfile(gAssetStorage->mVFS, req->getUUID(), req->getType());
+                LLVFile vfile(gAssetStorage->mVFS, file_id, file_type);
                 if (vfile.getSize() <= 0)
                 {
                         llwarns << "downloadCompleteCallback has non-existent or zero-size asset!" << llendl;
@@ -840,7 +839,9 @@ void LLAssetStorage::downloadInvItemCompleteCallback(
                 }
         }
 
-        req->mDownCallback(gAssetStorage->mVFS, req->getUUID(), req->getType(), req->mUserData, result, ext_status);
+        req->mDownCallback(gAssetStorage->mVFS, file_id, file_type, req->mUserData, result, ext_status);
+
+        delete req;
 }
 
 /////////////////////////////////////////////////////////////////////////////////////////////////////////////////