Fix crash caused by decryption response delay

If the interface is removed due to Wi-Fi being disabled
after a decryption request but before a response is received,
the problem occurs when the removed interface is referenced
in the reply callback.
Accordingly, it has been modified to cancel/ignore
the reply callback when WiFi is disabled.

Change-Id: Ic7effd691d066a4219f06a3ed937d5f5c6125a98
Signed-off-by: Jaehyun Kim <jeik01.kim@samsung.com>

3 files changed, 30 insertions, 1 deletions

diff --git a/gsupplicant/gsupplicant.h b/gsupplicant/gsupplicant.h
index 61b63dd6..4e841df0 100755
--- a/gsupplicant/gsupplicant.h
+++ b/gsupplicant/gsupplicant.h
@@ -404,9 +404,15 @@ int g_supplicant_interface_connect(GSupplicantInterface *interface,
 					GSupplicantInterfaceCallback callback,
 							void *user_data);
 
+#if defined TIZEN_EXT
+int g_supplicant_interface_disconnect(GSupplicantInterface *interface,
+					GSupplicantInterfaceCallback callback,
+					void *user_data, void *connman_network);
+#else
 int g_supplicant_interface_disconnect(GSupplicantInterface *interface,
 					GSupplicantInterfaceCallback callback,
 							void *user_data);
+#endif
 
 int g_supplicant_interface_set_bss_expiration_age(GSupplicantInterface *interface,
 					unsigned int bss_expiration_age);
diff --git a/gsupplicant/supplicant.c b/gsupplicant/supplicant.c
index d0033ed3..723f2cfb 100755
--- a/gsupplicant/supplicant.c
+++ b/gsupplicant/supplicant.c
@@ -7710,6 +7710,7 @@ static void crypt_method_call_cancel(void)
 	}
 
 	g_free(decrypt_request_data.data->path);
+	g_free(decrypt_request_data.data->ssid->ssid);
 	g_free(decrypt_request_data.data->ssid);
 	dbus_free(decrypt_request_data.data);
 	decrypt_request_data.data = NULL;
@@ -7727,6 +7728,11 @@ static void decryption_request_reply(DBusPendingCall *call,
 
 	SUPPLICANT_DBG("");
 
+	if (!decrypt_request_data.data) {
+		SUPPLICANT_DBG("decryption request is canceled");
+		return;
+	}
+
 	reply = dbus_pending_call_steal_reply(call);
 
 	dbus_error_init(&error);
@@ -8249,9 +8255,15 @@ static void interface_disconnect_result(const char *error,
 	}
 }
 
+#if defined TIZEN_EXT
+int g_supplicant_interface_disconnect(GSupplicantInterface *interface,
+					GSupplicantInterfaceCallback callback,
+					void *user_data, void *connman_network)
+#else
 int g_supplicant_interface_disconnect(GSupplicantInterface *interface,
 					GSupplicantInterfaceCallback callback,
 							void *user_data)
+#endif
 {
 	struct interface_data *data;
 	int ret;
@@ -8266,7 +8278,7 @@ int g_supplicant_interface_disconnect(GSupplicantInterface *interface,
 #if defined TIZEN_EXT
 	if (decrypt_request_data.pending_call &&
 			decrypt_request_data.data &&
-			decrypt_request_data.data->user_data == user_data) {
+			decrypt_request_data.data->user_data == connman_network) {
 
 		callback_assoc_failed(decrypt_request_data.data->user_data);
 		crypt_method_call_cancel();
diff --git a/plugins/wifi.c b/plugins/wifi.c
index 68f34313..9c5dfd72 100755
--- a/plugins/wifi.c
+++ b/plugins/wifi.c
@@ -4290,8 +4290,14 @@ static int network_disconnect(struct connman_network *network)
 	dd->wifi = wifi;
 	dd->network = network;
 
+#if defined TIZEN_EXT
+	err = g_supplicant_interface_disconnect(wifi->interface,
+					disconnect_callback, dd, network);
+#else
 	err = g_supplicant_interface_disconnect(wifi->interface,
 						disconnect_callback, dd);
+#endif
+
 	if (err < 0) {
 		wifi->disconnecting = false;
 		g_free(dd);
@@ -4630,8 +4636,13 @@ static bool handle_wps_completion(GSupplicantInterface *interface,
 			dd->network = network;
 
 			connman_network_set_associating(network, false);
+#if defined TIZEN_EXT
+			g_supplicant_interface_disconnect(wifi->interface,
+					disconnect_callback, dd, network);
+#else
 			g_supplicant_interface_disconnect(wifi->interface,
 						disconnect_callback, dd);
+#endif
 #if defined TIZEN_EXT
 			connman_network_set_bool(network, "WiFi.UseWPS", false);
 			connman_network_set_string(network, "WiFi.PinWPS", NULL);