diff options
| author | Szymon Janc <szymon.janc@gmail.com> | 2013-12-09 20:20:55 +0100 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2013-12-10 07:21:23 +0200 |
| commit | cbdeaef9d5486f38564d46934a9924a906cc93c7 (patch) | |
| tree | a8128cb4f29e2a4e61d7152fd25dd42a8c6c0092 | |
| parent | 9bf453f9f1d5fcc425670d2d989d198688d9ec54 (diff) | |
| download | bluez-cbdeaef9d5486f38564d46934a9924a906cc93c7.tar.gz | |
core: Fix crash due to agent callback freeing the agent
Similar fix was provided for simple_agent_reply in a2f5d438 but missed
pincode_reply case.
Fix following:
src/agent.c:agent_disconnect() Agent :1.48 disconnected
src/agent.c:set_default_agent() Default agent cleared
src/agent.c:agent_destroy() agent :1.48
src/agent.c:agent_unref() 0x4701c68: ref=1
Agent /org/bluez/agent replied with an error:
org.freedesktop.DBus.Error.NoReply, Message did not receive a reply
(timeout by message bus)
src/adapter.c:btd_adapter_pincode_reply() hci0 addr 6C:0E:0D:DB:D1:16
pinlen 0
src/agent.c:agent_unref() 0x4701c68: ref=0
src/adapter.c:btd_adapter_pincode_reply() hci0 addr 6C:0E:0D:DB:D1:16
pinlen 0
src/agent.c:agent_unref() 0x4701c68: ref=-1
src/adapter.c:btd_adapter_pincode_reply() hci0 addr 6C:0E:0D:DB:D1:16
pinlen 0
src/agent.c:agent_unref() 0x4701c68: ref=-2
...
| -rw-r--r-- | src/agent.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/agent.c b/src/agent.c index bcba969f4..4c63cb973 100644 --- a/src/agent.c +++ b/src/agent.c @@ -426,6 +426,9 @@ static void pincode_reply(DBusPendingCall *call, void *user_data) * is only called after a reply has been received */ message = dbus_pending_call_steal_reply(call); + /* Protect from the callback freeing the agent */ + agent_ref(agent); + dbus_error_init(&err); if (dbus_set_error_from_message(&err, message)) { error("Agent %s replied with an error: %s, %s", @@ -465,6 +468,7 @@ done: dbus_pending_call_cancel(req->call); agent->request = NULL; agent_request_free(req, TRUE); + agent_unref(agent); } static int pincode_request_new(struct agent_request *req, const char *device_path, |