|
 |
5d1d24 |
From 2a09e2b15e7493256de4f40331ce6be4e1fe90f4 Mon Sep 17 00:00:00 2001
|
|
|
5d1d24 |
From: Bastien Nocera <hadess@hadess.net>
|
|
|
5d1d24 |
Date: Thu, 3 Dec 2015 18:28:46 +0100
|
|
|
5d1d24 |
Subject: [PATCH] Fix possible use-after-free on exit
|
|
|
5d1d24 |
|
|
|
5d1d24 |
When the last client of dleyna-server exits, and dleyna-server
|
|
|
5d1d24 |
tries to exit, it might use the "upnp" pointer after it was freed as we
|
|
|
5d1d24 |
receive a signal where the user_data is invalid. Avoid that by zero'ing
|
|
|
5d1d24 |
freed pointers and disconnecting from the signal for which "upnp" is
|
|
|
5d1d24 |
user_data.
|
|
|
5d1d24 |
|
|
|
5d1d24 |
See https://retrace.fedoraproject.org/faf/reports/855440/
|
|
|
5d1d24 |
---
|
|
|
5d1d24 |
libdleyna/server/server.c | 5 ++++-
|
|
|
5d1d24 |
libdleyna/server/upnp.c | 3 +++
|
|
|
5d1d24 |
2 files changed, 7 insertions(+), 1 deletion(-)
|
|
|
5d1d24 |
|
|
|
5d1d24 |
diff --git a/libdleyna/server/server.c b/libdleyna/server/server.c
|
|
|
5d1d24 |
index ec725de3f6b3..865336162d61 100644
|
|
|
5d1d24 |
--- a/libdleyna/server/server.c
|
|
|
5d1d24 |
+++ b/libdleyna/server/server.c
|
|
|
5d1d24 |
@@ -1352,12 +1352,15 @@ static void prv_control_point_stop_service(void)
|
|
|
5d1d24 |
{
|
|
|
5d1d24 |
uint i;
|
|
|
5d1d24 |
|
|
|
5d1d24 |
- if (g_context.manager)
|
|
|
5d1d24 |
+ if (g_context.manager) {
|
|
|
5d1d24 |
dls_manager_delete(g_context.manager);
|
|
|
5d1d24 |
+ g_context.manager = NULL;
|
|
|
5d1d24 |
+ }
|
|
|
5d1d24 |
|
|
|
5d1d24 |
if (g_context.upnp) {
|
|
|
5d1d24 |
dls_upnp_unsubscribe(g_context.upnp);
|
|
|
5d1d24 |
dls_upnp_delete(g_context.upnp);
|
|
|
5d1d24 |
+ g_context.upnp = NULL;
|
|
|
5d1d24 |
}
|
|
|
5d1d24 |
|
|
|
5d1d24 |
if (g_context.connection) {
|
|
|
5d1d24 |
diff --git a/libdleyna/server/upnp.c b/libdleyna/server/upnp.c
|
|
|
5d1d24 |
index 6d6c696dd42c..dcf31d98f171 100755
|
|
|
5d1d24 |
--- a/libdleyna/server/upnp.c
|
|
|
5d1d24 |
+++ b/libdleyna/server/upnp.c
|
|
|
5d1d24 |
@@ -547,6 +547,9 @@ dls_upnp_t *dls_upnp_new(dleyna_connector_id_t connection,
|
|
|
5d1d24 |
void dls_upnp_delete(dls_upnp_t *upnp)
|
|
|
5d1d24 |
{
|
|
|
5d1d24 |
if (upnp) {
|
|
|
5d1d24 |
+ g_signal_handlers_disconnect_by_func (G_OBJECT (upnp->context_manager),
|
|
|
5d1d24 |
+ G_CALLBACK(prv_on_context_available),
|
|
|
5d1d24 |
+ upnp);
|
|
|
5d1d24 |
g_object_unref(upnp->context_manager);
|
|
|
5d1d24 |
g_hash_table_unref(upnp->property_map);
|
|
|
5d1d24 |
g_hash_table_unref(upnp->filter_map);
|
|
|
5d1d24 |
--
|
|
|
5d1d24 |
2.5.5
|
|
|
5d1d24 |
|