From edf80104e32830a3d4ec58f88f9a092c32203d8a Mon Sep 17 00:00:00 2001 From: Tanu Kaskinen Date: Wed, 26 Aug 2009 14:17:35 +0300 Subject: dbus: Make sure that subscription callbacks don't try to access removed objects. --- src/modules/dbus/iface-card.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/modules/dbus/iface-card.c') diff --git a/src/modules/dbus/iface-card.c b/src/modules/dbus/iface-card.c index fce44ff7..7e37f8bb 100644 --- a/src/modules/dbus/iface-card.c +++ b/src/modules/dbus/iface-card.c @@ -465,6 +465,10 @@ static void subscription_cb(pa_core *core, pa_subscription_event_type_t t, uint3 pa_assert((t & PA_SUBSCRIPTION_EVENT_FACILITY_MASK) == PA_SUBSCRIPTION_EVENT_CARD); pa_assert(c); + /* We can't use idx != c->card->index, because the c->card pointer may + * be stale at this point. */ + if (pa_idxset_get_by_index(core->cards, idx) != c->card) + return; if ((t & PA_SUBSCRIPTION_EVENT_TYPE_MASK) != PA_SUBSCRIPTION_EVENT_CHANGE) return; -- cgit