NIO select issue makes program crash

[Liu Huadong]

Hi Google expert and socket expert
We meet a crash issue when using NIO selector.
After check the stack we find it die in free(fdset_read);

Did you meet the same issue?
Do you have solution to avoid this issue ?
Any suggestions are welcome.
Thanks

Regards
Huadong

static jint osNetworkSystem_selectImpl(JNIEnv* env, jclass clazz,
jobjectArray readFDArray, jobjectArray writeFDArray, jint
countReadC,
jint countWriteC, jintArray outFlags, jlong timeout) {
// LOGD("ENTER selectImpl");

struct timeval timeP;
int result = 0;
int size = 0;
jobject gotFD;
fd_set *fdset_read,*fdset_write;
int handle;
jboolean isCopy ;
jint *flagArray;
int val;
unsigned int time_sec = (unsigned int)timeout/1000;
unsigned int time_msec = (unsigned int)(timeout%1000)*1000;

fdset_read = (fd_set *)malloc(sizeof(fd_set));
fdset_write = (fd_set *)malloc(sizeof(fd_set));

FD_ZERO(fdset_read);
FD_ZERO(fdset_write);

for (val = 0; val<countReadC; val++) {

gotFD = env->GetObjectArrayElement(readFDArray,val);

handle = jniGetFDFromFileDescriptor(env, gotFD);

FD_SET(handle, fdset_read);

if (0 > (size - handle)) {
size = handle;
}
}

for (val = 0; val<countWriteC; val++) {

gotFD = env->GetObjectArrayElement(writeFDArray,val);

handle = jniGetFDFromFileDescriptor(env, gotFD);

FD_SET(handle, fdset_write);

if (0 > (size - handle)) {
size = handle;
}
}
/* the size is the max_fd + 1 */
size =size + 1;

if (0 > size) {
result = SOCKERR_FDSET_SIZEBAD;
} else {
/* only set when timeout >= 0 (non-block)*/
if (0 <= timeout) {

timeP.tv_sec = time_sec;
timeP.tv_usec = time_msec*1000;

result = sockSelect(size, fdset_read, fdset_write, NULL,
&timeP);

} else {
result = sockSelect(size, fdset_read, fdset_write, NULL,
NULL);
}
}

if (0 < result) {
/*output the result to a int array*/
flagArray = env->GetIntArrayElements(outFlags, &isCopy);

for (val=0; val<countReadC; val++) {
gotFD = env->GetObjectArrayElement(readFDArray,val);

handle = jniGetFDFromFileDescriptor(env, gotFD);

if (FD_ISSET(handle,fdset_read)) {
flagArray[val] = SOCKET_OP_READ;
} else {
flagArray[val] = SOCKET_OP_NONE;
}
}

for (val=0; val<countWriteC; val++) {

gotFD = env->GetObjectArrayElement(writeFDArray,val);

handle = jniGetFDFromFileDescriptor(env, gotFD);

if (FD_ISSET(handle,fdset_write)) {
flagArray[val+countReadC] = SOCKET_OP_WRITE;
} else {
flagArray[val+countReadC] = SOCKET_OP_NONE;
}
}

env->ReleaseIntArrayElements(outFlags, flagArray, 0);
}

free(fdset_write);
dead here free(fdset_read);

/* return both correct and error result, let java handle the
exception*/
return result;
}