summaryrefslogtreecommitdiff
path: root/src/libsystemd/sd-bus/bus-match.c
diff options
context:
space:
mode:
authorWeng Xuetian <wengxt@gmail.com>2016-06-29 13:22:12 -0700
committerLennart Poettering <lennart@poettering.net>2016-06-29 22:22:12 +0200
commitf0d5c5be5923f3342d0de1241e30650b1d57d551 (patch)
tree1f81369ad57a052204cbb478e4a8a6d14e85111f /src/libsystemd/sd-bus/bus-match.c
parentd6568222d74bdfbeb75e37e96b64248ec0145dea (diff)
sd-bus: Fix a read after free error in bus-match. (#3624) (#3625)
The loop on bus_match_run should break and return immediately if bus->match_callbacks_modified is true. Otherwise the loop may access free'd data.
Diffstat (limited to 'src/libsystemd/sd-bus/bus-match.c')
-rw-r--r--src/libsystemd/sd-bus/bus-match.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/src/libsystemd/sd-bus/bus-match.c b/src/libsystemd/sd-bus/bus-match.c
index 397baf6f33..db01f21135 100644
--- a/src/libsystemd/sd-bus/bus-match.c
+++ b/src/libsystemd/sd-bus/bus-match.c
@@ -429,6 +429,9 @@ int bus_match_run(
r = bus_match_run(bus, c, m);
if (r != 0)
return r;
+
+ if (bus && bus->match_callbacks_modified)
+ return 0;
}
}