Parent: 2fd93cc6e5d5ad99493971b298672b2e0c0ca48c
Author: Johan Hedberg <johan.hedberg@intel.com>
Committer: Johan Hedberg <johan.hedberg@intel.com>
Date: 2012-09-26 21:45:05
Tree: 2a509d695c9b2254a40cf3ce591944983e1b9449
gdbus: Fix crash when getting disconnected from the bus When getting disconnected from the bus sometimes (maybe always?) dbus_watch_handle() can cause the "info" context to be free'd meaning that we should not try to access it after the call. The only member we need access to is the connection pointer and as the code already has a ref() call for it it's only natural to solve the issue by adding a local variable not dependent on "info". The backtrace of the crash fixed looks as follows: Invalid read of size 8 at 0x121085: watch_func (mainloop.c:105) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551) Address 0x5bbcd90 is 16 bytes inside a block of size 24 free'd at 0x4A079AE: free (vg_replace_malloc.c:427) by 0x4C7837E: g_free (gmem.c:252) by 0x4F708BF: dbus_watch_set_data (dbus-watch.c:614) by 0x4F70938: _dbus_watch_unref (dbus-watch.c:132) by 0x4F6E9A7: _dbus_transport_handle_watch (dbus-transport.c:884) by 0x4F59AFB: _dbus_connection_handle_watch (dbus-connection.c:1497) by 0x4F70AF9: dbus_watch_handle (dbus-watch.c:683) by 0x121084: watch_func (mainloop.c:103) by 0x4C72694: g_main_context_dispatch (gmain.c:2539) by 0x4C729C7: g_main_context_iterate.isra.23 (gmain.c:3146) by 0x4C72DC1: g_main_loop_run (gmain.c:3340) by 0x120541: main (main.c:551)
Diffstat
| M | gdbus/mainloop.c | | | 9 | +++++- - - - |
1 files changed, 5 insertions(+), 4 deletions(-)