From 81dbaa0631a2a38fb769f69817e33d18d1a0d484 Mon Sep 17 00:00:00 2001 From: Johan Hedberg Date: Wed, 26 Sep 2012 21:45:05 +0300 Subject: gdbus: Fix crash when getting disconnected from the bus When getting disconnected from the bus sometimes (maybe always?) dbus_watch_handle() can cause the "info" context to be free'd meaning that we should not try to access it after the call. The only member we need access to is the connection pointer and as the code already has a ref() call for it it's only natural to solve the issue by adding a local variable not dependent on "info". The backtrace of the crash fixed looks as follows: Invalid read of size 8 at 0x121085: watch_func (mainloop.c:105) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551) Address 0x5bbcd90 is 16 bytes inside a block of size 24 free'd at 0x4A079AE: free (vg_replace_malloc.c:427) by 0x4C7837E: g_free (gmem.c:252) by 0x4F708BF: dbus_watch_set_data (dbus-watch.c:614) by 0x4F70938: _dbus_watch_unref (dbus-watch.c:132) by 0x4F6E9A7: _dbus_transport_handle_watch (dbus-transport.c:884) by 0x4F59AFB: _dbus_connection_handle_watch (dbus-connection.c:1497) by 0x4F70AF9: dbus_watch_handle (dbus-watch.c:683) by 0x121084: watch_func (mainloop.c:103) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551) --- gdbus/mainloop.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/gdbus/mainloop.c b/gdbus/mainloop.c index cff326f..099b67f 100644 --- a/gdbus/mainloop.c +++ b/gdbus/mainloop.c @@ -92,8 +92,9 @@ static gboolean watch_func(GIOChannel *chan, GIOCondition cond, gpointer data) struct watch_info *info = data; unsigned int flags = 0; DBusDispatchStatus status; + DBusConnection *conn; - dbus_connection_ref(info->conn); + conn = dbus_connection_ref(info->conn); if (cond & G_IO_IN) flags |= DBUS_WATCH_READABLE; if (cond & G_IO_OUT) flags |= DBUS_WATCH_WRITABLE; @@ -102,10 +103,10 @@ static gboolean watch_func(GIOChannel *chan, GIOCondition cond, gpointer data) dbus_watch_handle(info->watch, flags); - status = dbus_connection_get_dispatch_status(info->conn); - queue_dispatch(info->conn, status); + status = dbus_connection_get_dispatch_status(conn); + queue_dispatch(conn, status); - dbus_connection_unref(info->conn); + dbus_connection_unref(conn); return TRUE; } -- cgit v1.2.1