summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorDavid Herrmann <dh.herrmann@gmail.com>2014-08-28 12:42:03 +0200
committerDavid Herrmann <dh.herrmann@gmail.com>2014-08-28 12:45:51 +0200
commitd974ad0524942882f489914013d08ab16d147170 (patch)
treebf184fa3e3d1a474f12b6a45908f27620bf2881e /src
parentfa9838ddd62ea31f8aea99757916a16d76b31cbc (diff)
bus: fix use-after-free in slot-release
We must not access slot->floating after we possible dropped the last reference to it. Fix all callback-invocations to first check slot->floating and possible disconnect the slot, then release the last reference.
Diffstat (limited to 'src')
-rw-r--r--src/libsystemd/sd-bus/sd-bus.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
index a204d67590..8caa404227 100644
--- a/src/libsystemd/sd-bus/sd-bus.c
+++ b/src/libsystemd/sd-bus/sd-bus.c
@@ -2107,7 +2107,7 @@ static int process_timeout(sd_bus *bus) {
r = c->callback(bus, m, slot->userdata, &error_buffer);
bus->current_userdata = NULL;
bus->current_handler = NULL;
- bus->current_slot = sd_bus_slot_unref(slot);
+ bus->current_slot = NULL;
bus->current_message = NULL;
if (slot->floating) {
@@ -2115,6 +2115,8 @@ static int process_timeout(sd_bus *bus) {
sd_bus_slot_unref(slot);
}
+ sd_bus_slot_unref(slot);
+
return bus_maybe_reply_error(m, r, &error_buffer);
}
@@ -2203,13 +2205,15 @@ static int process_reply(sd_bus *bus, sd_bus_message *m) {
r = c->callback(bus, m, slot->userdata, &error_buffer);
bus->current_userdata = NULL;
bus->current_handler = NULL;
- bus->current_slot = sd_bus_slot_unref(slot);
+ bus->current_slot = NULL;
if (slot->floating) {
bus_slot_disconnect(slot);
sd_bus_slot_unref(slot);
}
+ sd_bus_slot_unref(slot);
+
return bus_maybe_reply_error(m, r, &error_buffer);
}
@@ -2529,7 +2533,7 @@ static int process_closing(sd_bus *bus, sd_bus_message **ret) {
r = c->callback(bus, m, slot->userdata, &error_buffer);
bus->current_userdata = NULL;
bus->current_handler = NULL;
- bus->current_slot = sd_bus_slot_unref(slot);
+ bus->current_slot = NULL;
bus->current_message = NULL;
if (slot->floating) {
@@ -2537,6 +2541,8 @@ static int process_closing(sd_bus *bus, sd_bus_message **ret) {
sd_bus_slot_unref(slot);
}
+ sd_bus_slot_unref(slot);
+
return bus_maybe_reply_error(m, r, &error_buffer);
}