File 0010-bluetooth-fix-invalid-memory-access.patch of Package pulseaudio

Overview Repositories Revisions Requests Users Attributes Meta

File 0010-bluetooth-fix-invalid-memory-access.patch of Package pulseaudio

From 4bcb1a909f936a63628273e7d35726bc64785eeb Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 13 Jan 2010 17:24:37 +0100
Subject: [PATCH] bluetooth: fix invalid memory access

When an GetProperties() reply arrives after we already deleted the
device structure for it make sure we don't accidentaly touch the
invalidated object.

https://bugzilla.redhat.com/show_bug.cgi?id=543205
---
 src/modules/bluetooth/bluetooth-util.c |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)

diff --git a/src/modules/bluetooth/bluetooth-util.c b/src/modules/bluetooth/bluetooth-util.c
index 795d510..b2c0429 100644
--- a/src/modules/bluetooth/bluetooth-util.c
+++ b/src/modules/bluetooth/bluetooth-util.c
@@ -342,7 +342,13 @@ static void get_properties_reply(DBusPendingCall *pending, void *userdata) {
 /*                  dbus_message_get_interface(p->message), */
 /*                  dbus_message_get_path(p->message)); */
 
-    d = p->call_data;
+    /* We don't use p->call_data here right-away since the device
+     * might already be invalidated at this point */
+
+    if (!(d = pa_hashmap_get(y->devices, dbus_message_get_path(p->message))))
+        return;
+
+    pa_assert(p->call_data == d);
 
     valid = dbus_message_get_type(r) == DBUS_MESSAGE_TYPE_ERROR ? -1 : 1;
 
-- 
1.6.0.2

Places

File 0010-bluetooth-fix-invalid-memory-access.patch of Package pulseaudio

Places