diff options
| author | Simon McVittie <smcv@collabora.com> | 2020-02-20 00:36:53 +0000 |
|---|---|---|
| committer | Simon McVittie <smcv@collabora.com> | 2020-02-25 12:50:08 +0000 |
| commit | 2c6b0ad7f6bc0727717d455894f51cbb39b77bf3 (patch) | |
| tree | ce9b74600d57dcab1dc9f2bc6b8b3acab9ef6896 | |
| parent | df0c675b93c9521e1264ce906a70f239923c5b61 (diff) | |
| download | dbus-2c6b0ad7f6bc0727717d455894f51cbb39b77bf3.tar.gz dbus-2c6b0ad7f6bc0727717d455894f51cbb39b77bf3.tar.bz2 dbus-2c6b0ad7f6bc0727717d455894f51cbb39b77bf3.zip | |
bus: Don't explicitly clear BusConnections.monitors
Each connection that is an active monitor holds a pointer to its own
link in this list, via BusConnectionData.link_in_monitors. We can't
validly free the list while these pointers exist: that would be a
use-after-free, when each connection gets disconnected and tries to
remove itself from the list.
Instead, let each connection remove itself from the list, then assert
that the list has become empty.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/291
(cherry picked from commit b034b83b59efffd4cc819ad42d0cd078d91d53df)
| -rw-r--r-- | bus/connection.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/bus/connection.c b/bus/connection.c index 53605fa3..b3583433 100644 --- a/bus/connection.c +++ b/bus/connection.c @@ -537,9 +537,6 @@ bus_connections_unref (BusConnections *connections) _dbus_assert (connections->n_incomplete == 0); - /* drop all monitors */ - _dbus_list_clear (&connections->monitors); - /* drop all real connections */ while (connections->completed != NULL) { @@ -555,6 +552,10 @@ bus_connections_unref (BusConnections *connections) _dbus_assert (connections->n_completed == 0); + /* disconnecting all the connections should have emptied the list of + * monitors (each link is removed in bus_connection_disconnected) */ + _dbus_assert (connections->monitors == NULL); + bus_expire_list_free (connections->pending_replies); _dbus_loop_remove_timeout (bus_context_get_loop (connections->context), |