Prevent a crash in some applications due to timers leaking after the

DVusPendingCall object was freed.

    * dbus-connection.c: Remove the timer for the pending call's timeout in
      case the reply has timed out in blocking code. This fixes bug 15684.

1 files changed, 7 insertions, 0 deletions

diff --git a/dbus/dbus-connection.c b/dbus/dbus-connection.c
index 3a1670ca..7b13b249 100644
--- a/dbus/dbus-connection.c
+++ b/dbus/dbus-connection.c
@@ -965,6 +965,13 @@ _dbus_connection_detach_pending_call_and_unlock (DBusConnection  *connection,
   _dbus_pending_call_ref_unlocked (pending);
   _dbus_hash_table_remove_int (connection->pending_replies,
                                _dbus_pending_call_get_reply_serial_unlocked (pending));
+
+  if (_dbus_pending_call_is_timeout_added_unlocked (pending))
+      _dbus_connection_remove_timeout_unlocked (connection,
+              _dbus_pending_call_get_timeout_unlocked (pending));
+
+  _dbus_pending_call_set_timeout_added_unlocked (pending, FALSE);
+
   _dbus_pending_call_unref_and_unlock (pending);
 }