diff options
| author | Lennart Poettering <lennart@poettering.net> | 2010-01-13 17:24:37 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2010-01-13 17:24:37 +0100 |
| commit | 4bcb1a909f936a63628273e7d35726bc64785eeb (patch) | |
| tree | bcc58f60e693ac2102627675b968de44f83b1ac3 /src/modules/bluetooth | |
| parent | 73ae1fce001253677b7ab633f42d3c3300fe5cf5 (diff) | |
bluetooth: fix invalid memory access
When an GetProperties() reply arrives after we already deleted the
device structure for it make sure we don't accidentaly touch the
invalidated object.
https://bugzilla.redhat.com/show_bug.cgi?id=543205
Diffstat (limited to 'src/modules/bluetooth')
| -rw-r--r-- | src/modules/bluetooth/bluetooth-util.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/src/modules/bluetooth/bluetooth-util.c b/src/modules/bluetooth/bluetooth-util.c index 795d5108..b2c04293 100644 --- a/src/modules/bluetooth/bluetooth-util.c +++ b/src/modules/bluetooth/bluetooth-util.c @@ -342,7 +342,13 @@ static void get_properties_reply(DBusPendingCall *pending, void *userdata) { /* dbus_message_get_interface(p->message), */ /* dbus_message_get_path(p->message)); */ - d = p->call_data; + /* We don't use p->call_data here right-away since the device + * might already be invalidated at this point */ + + if (!(d = pa_hashmap_get(y->devices, dbus_message_get_path(p->message)))) + return; + + pa_assert(p->call_data == d); valid = dbus_message_get_type(r) == DBUS_MESSAGE_TYPE_ERROR ? -1 : 1; |