Linux bluetooth development
 help / color / mirror / Atom feed
* [PATCH 1/3] Fix possible crash when processing session callback
@ 2010-12-07 15:00 Luiz Augusto von Dentz
  2010-12-07 15:01 ` [PATCH 2/3] Fix logging for obex-client Luiz Augusto von Dentz
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Luiz Augusto von Dentz @ 2010-12-07 15:00 UTC (permalink / raw)
  To: linux-bluetooth

From: Luiz Augusto von Dentz <luiz.dentz-von@nokia.com>

If the callback removes the pending data it cause this:

==20639== Invalid read of size 4
==20639==    at 0x80553E9: free_pending (session.c:112)
==20639==    by 0x8056C83: session_request_reply (session.c:837)
==20639==    by 0x412F7E0: ??? (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x411D975: ??? (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x4120B81: dbus_connection_dispatch (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x804C27F: message_dispatch (mainloop.c:80)
==20639==    by 0x407EFCB: ??? (in /lib/libglib-2.0.so.0.2600.1)
==20639==    by 0x407E854: g_main_context_dispatch (in /lib/libglib-2.0.so.0.2600.1)
==20639==    by 0x4082667: ??? (in /lib/libglib-2.0.so.0.2600.1)
==20639==    by 0x4082BA6: g_main_loop_run (in /lib/libglib-2.0.so.0.2600.1)
==20639==    by 0x8055171: main (main.c:625)
==20639==  Address 0x4363c88 is 0 bytes inside a block of size 12 free'd
==20639==    at 0x40257ED: free (vg_replace_malloc.c:366)
==20639==    by 0x4087485: g_free (in /lib/libglib-2.0.so.0.2600.1)
==20639==    by 0x80553FE: free_pending (session.c:115)
==20639==    by 0x805543C: agent_free (session.c:127)
==20639==    by 0x80566A6: session_free (session.c:149)
==20639==    by 0x8056BCA: session_terminate_transfer (session.c:914)
==20639==    by 0x8056F61: session_prepare_put (session.c:1397)
==20639==    by 0x8056C74: session_request_reply (session.c:835)
==20639==    by 0x412F7E0: ??? (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x411D975: ??? (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x4120B81: dbus_connection_dispatch (in /lib/libdbus-1.so.3.5.2)
==20639==    by 0x804C27F: message_dispatch (mainloop.c:80)

To fix this agent->pending is now reset to NULL before calling the
callback, so even if the session is terminated it won't cause a free to
pending data, which is fine since it is latter freed on callback return.
---
 client/session.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/client/session.c b/client/session.c
index 223a2d3..88eae8d 100644
--- a/client/session.c
+++ b/client/session.c
@@ -832,10 +832,11 @@ static void session_request_reply(DBusPendingCall *call, gpointer user_data)
 		pending->transfer->name = g_strdup(name);
 	}
 
+	agent->pending = NULL;
+
 	pending->cb(session, NULL, pending->transfer);
 	dbus_message_unref(reply);
 	free_pending(pending);
-	agent->pending = NULL;
 
 	return;
 }
-- 
1.7.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2010-12-07 21:17 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-12-07 15:00 [PATCH 1/3] Fix possible crash when processing session callback Luiz Augusto von Dentz
2010-12-07 15:01 ` [PATCH 2/3] Fix logging for obex-client Luiz Augusto von Dentz
2010-12-07 15:01 ` [PATCH 3/3] Add support for stat files bigger than 2GB on 32-bit systems Luiz Augusto von Dentz
2010-12-07 21:17 ` [PATCH 1/3] Fix possible crash when processing session callback Johan Hedberg

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox