diff options
| author | Martin Xu <martin.xu@intel.com> | 2010-04-09 16:06:47 +0800 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2010-04-09 12:56:05 +0200 |
| commit | 67f5b07184ee3ebb9763a260dd622d51b75b04f4 (patch) | |
| tree | efea7ea80f16ffb77e9f6a2bec0c638ede1678e0 /plugins/bluetooth.c | |
| parent | 1163049a2c9d1306a470294245fce20d06965761 (diff) | |
| download | connman-67f5b07184ee3ebb9763a260dd622d51b75b04f4.tar.gz connman-67f5b07184ee3ebb9763a260dd622d51b75b04f4.tar.bz2 connman-67f5b07184ee3ebb9763a260dd622d51b75b04f4.zip | |
Reference PAN network before disconnecting
The PAN network can be destructed before getting the disconnect reply. In
that case disconnect_reply() will segfault by calling
connman_network_set_connected() with a NULL network pointer.
This issue is fixed by referencing the PAN network from pan_disconnect().
Diffstat (limited to 'plugins/bluetooth.c')
| -rw-r--r-- | plugins/bluetooth.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/plugins/bluetooth.c b/plugins/bluetooth.c index cec5e641..ee91b7fb 100644 --- a/plugins/bluetooth.c +++ b/plugins/bluetooth.c @@ -188,6 +188,8 @@ done: dbus_message_unref(reply); dbus_pending_call_unref(call); + + connman_network_unref(network); } static int pan_disconnect(struct connman_network *network) @@ -223,6 +225,8 @@ static int pan_disconnect(struct connman_network *network) return -EINVAL; } + connman_network_ref(network); + dbus_pending_call_set_notify(call, disconnect_reply, network, NULL); dbus_message_unref(message); |