Re: [PATCH] network: Fix use-after-free caused by Scan() in poor reception.

[Denis Kenzior <denkenz@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1302 bytes --]

Hi John,

On 12/21/2015 04:03 AM, John Ernberg wrote:
> From: John Ernberg <john.ernberg@actia.se>
>
> When issuing a Scan() in poor reception while attached to an operator it's
> fully possible to get no results, which causes the attached operator to be
> cleaned up. In certain scenarios this would cause a use-after-free.
> Make sure to clean up all the references to the operator when it's destroyed.
> ---
>   src/network.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/src/network.c b/src/network.c
> index 1dddcac..5329c28 100644
> --- a/src/network.c
> +++ b/src/network.c
> @@ -257,6 +257,9 @@ static void network_operator_destroy(gpointer user_data)
>   {
>   	struct network_operator_data *op = user_data;
>
> +	if (op->netreg->current_operator == op)
> +		op->netreg->current_operator = NULL;
> +

I'm not sure this is the right fix.  This will result in subsequent API 
calls to return inconsistent information related to the network 
operator.  For example, NetworkRegistration.Name, 
NetworkRegistration.MobileNetworkCode, 
NetworkRegistration.MobileCountryCode will be omitted.

Can we make sure that the current operator is not destroyed / 
unregistered in this particular situation?

>   	g_free(op);
>   }
>
>

Regards,
-Denis