sysmocom
/
ofono
mirror of git://git.sysmocom.de/ofono
11
0
Fork 0
Code Issues Releases Activity

gdbus: Fix use after free 

Refactor filter_data_remove_callback so that we do not iterate over
freed pointer.
This commit is contained in:
Andrei Emeltchenko 2014-08-11 10:50:44 +03:00 committed by Marcel Holtmann
parent 9aeea028ed
commit 8a4c29ca74
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
gdbus/watch.c
View File

@ -362,6 +362,7 @@ static void service_data_free(struct service_data *data)
callback->data = NULL; callback->data = NULL;
} }
/* Returns TRUE if data is freed */
static gboolean filter_data_remove_callback(struct filter_data *data, static gboolean filter_data_remove_callback(struct filter_data *data,
struct filter_callback *cb) struct filter_callback *cb)
{ {
@ -383,7 +384,7 @@ static gboolean filter_data_remove_callback(struct filter_data *data,
/* Don't remove the filter if other callbacks exist or data is lock /* Don't remove the filter if other callbacks exist or data is lock
* processing callbacks */ * processing callbacks */
if (data->callbacks || data->lock) if (data->callbacks || data->lock)
return TRUE; return FALSE;
if (data->registered && !remove_match(data)) if (data->registered && !remove_match(data))
return FALSE; return FALSE;
@ -405,7 +406,9 @@ static DBusHandlerResult signal_filter(DBusConnection *connection,
if (cb->signal_func && !cb->signal_func(connection, message, if (cb->signal_func && !cb->signal_func(connection, message,
cb->user_data)) { cb->user_data)) {
filter_data_remove_callback(data, cb); if (filter_data_remove_callback(data, cb))
break;
continue; continue;
} }
@ -489,7 +492,9 @@ static DBusHandlerResult service_filter(DBusConnection *connection,
/* Only auto remove if it is a bus name watch */ /* Only auto remove if it is a bus name watch */
if (data->argument[0] == ':' && if (data->argument[0] == ':' &&
(cb->conn_func == NULL || cb->disc_func == NULL)) { (cb->conn_func == NULL || cb->disc_func == NULL)) {
filter_data_remove_callback(data, cb); if (filter_data_remove_callback(data, cb))
break;
continue; continue;
} }