tests: Implement UpClient use-after-free test

1 files changed, 70 insertions, 0 deletions

diff --git a/tests/test_battery.c b/tests/test_battery.c
index 938af139..35029ef4 100644
--- a/tests/test_battery.c
+++ b/tests/test_battery.c
@@ -8,6 +8,28 @@
 #include <bluetooth-device.h>
 #include <libupower-glib/upower.h>
 
+static void
+remove_upower_device (GDBusConnection *bus,
+		      const char      *object_path)
+{
+	g_autoptr(GVariant) ret = NULL;
+	g_autoptr(GError) error = NULL;
+
+	ret = g_dbus_connection_call_sync (bus,
+					   "org.freedesktop.UPower",
+					   "/org/freedesktop/UPower",
+					   "org.freedesktop.DBus.Mock",
+					   "RemoveDevice",
+					   g_variant_new ("(o)", object_path),
+					   NULL,
+					   G_DBUS_CALL_FLAGS_NONE,
+					   -1,
+					   NULL,
+					   &error);
+	g_assert_no_error (error);
+	g_assert_nonnull (ret);
+}
+
 int main (int argc, char **argv)
 {
 	BluetoothClient *client;
@@ -54,5 +76,53 @@ int main (int argc, char **argv)
 	g_clear_object (&client);
 	g_clear_object (&list_store);
 
+	/* Start use-after-free test */
+	BluetoothClient *client2;
+	GListStore *list_store2;
+
+	client2 = bluetooth_client_new ();
+	list_store2 = bluetooth_client_get_devices (client2);
+
+	while (g_list_model_get_n_items (G_LIST_MODEL (list_store2)) != 2)
+		g_main_context_iteration (NULL, TRUE);
+	g_assert_cmpuint (g_list_model_get_n_items (G_LIST_MODEL (list_store2)), ==, 2);
+
+	BluetoothDevice *device2;
+	device2 = g_list_model_get_item (G_LIST_MODEL (list_store2), 0);
+	g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+	while (battery_type != BLUETOOTH_BATTERY_TYPE_PERCENTAGE) {
+		g_main_context_iteration (NULL, TRUE);
+		g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+	}
+
+	GDBusConnection *bus;
+	bus = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, NULL);
+	remove_upower_device (bus, "/org/freedesktop/UPower/devices/mouse_dev_11_22_33_44_55_66");
+	g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+	while (battery_type != BLUETOOTH_BATTERY_TYPE_NONE) {
+		g_main_context_iteration (NULL, TRUE);
+		g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+	}
+	g_object_unref (G_OBJECT (device2));
+
+	g_dbus_connection_call_sync (bus,
+				     "org.bluez",
+				     "/org/bluez/hci0",
+				     "org.bluez.Adapter1",
+				     "RemoveDevice",
+				     g_variant_new ("(o)", "/org/bluez/hci0/dev_11_22_33_44_55_67"),
+				     NULL,
+				     G_DBUS_CALL_FLAGS_NONE,
+				     -1,
+				     NULL,
+				     NULL);
+	remove_upower_device (bus, "/org/freedesktop/UPower/devices/mouse_dev_11_22_33_44_55_67");
+	while (g_list_model_get_n_items (G_LIST_MODEL (list_store2)) != 1)
+		g_main_context_iteration (NULL, TRUE);
+	g_assert_cmpuint (g_list_model_get_n_items (G_LIST_MODEL (list_store2)), ==, 1);
+
+	g_object_unref (G_OBJECT (list_store2));
+	g_object_unref (G_OBJECT (client2));
+
 	return 0;
 }