From f0d5c5be5923f3342d0de1241e30650b1d57d551 Mon Sep 17 00:00:00 2001 From: Weng Xuetian Date: Wed, 29 Jun 2016 13:22:12 -0700 Subject: sd-bus: Fix a read after free error in bus-match. (#3624) (#3625) The loop on bus_match_run should break and return immediately if bus->match_callbacks_modified is true. Otherwise the loop may access free'd data. --- src/libsystemd/sd-bus/bus-match.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'src/libsystemd/sd-bus/bus-match.c') diff --git a/src/libsystemd/sd-bus/bus-match.c b/src/libsystemd/sd-bus/bus-match.c index 397baf6f33..db01f21135 100644 --- a/src/libsystemd/sd-bus/bus-match.c +++ b/src/libsystemd/sd-bus/bus-match.c @@ -429,6 +429,9 @@ int bus_match_run( r = bus_match_run(bus, c, m); if (r != 0) return r; + + if (bus && bus->match_callbacks_modified) + return 0; } } -- cgit v1.2.3-54-g00ecf