|
 |
204d18 |
From 3f62e9fbd3de11df52184ca8dfcabfb7d1c0fdeb Mon Sep 17 00:00:00 2001
|
|
|
204d18 |
From: Robert Tiemann <rtie@gmx.de>
|
|
|
204d18 |
Date: Fri, 17 May 2019 12:43:04 +0200
|
|
|
204d18 |
Subject: [PATCH] Avoid possible crash when getting server properties.
|
|
|
204d18 |
|
|
|
204d18 |
The crash occurs when calling dls_device_get_all_props() for a content
|
|
|
204d18 |
directory server that we have not yet subscribed to (that is,
|
|
|
204d18 |
prv_cds_subscribed() returns FALSE in
|
|
|
204d18 |
prv_get_system_update_id_for_props()). This crash is caused by an
|
|
|
204d18 |
invalid GVariantBuilder passed to g_variant_builder_end() in
|
|
|
204d18 |
prv_get_sleeping_for_props(), leading to a NULL result pointer being
|
|
|
204d18 |
passed to dls_async_task_complete(). A GVariant is attempted to be
|
|
|
204d18 |
constructed from this NULL pointer in dls_task_complete().
|
|
|
204d18 |
|
|
|
204d18 |
Here is the call chain that leads to the crash:
|
|
|
204d18 |
|
|
|
204d18 |
dls_device_get_all_props()
|
|
|
204d18 |
prv_get_system_update_id_for_props()
|
|
|
204d18 |
gupnp_service_proxy_begin_action("GetSystemUpdateID") -> prv_system_update_id_for_props_cb()
|
|
|
204d18 |
prv_system_update_id_for_props_cb()
|
|
|
204d18 |
prv_get_sr_token_for_props()
|
|
|
204d18 |
prv_get_sleeping_for_props()
|
|
|
204d18 |
dls_async_task_complete()
|
|
|
204d18 |
cb_data->cb() -> prv_async_task_complete()
|
|
|
204d18 |
prv_async_task_complete()
|
|
|
204d18 |
dls_task_complete()
|
|
|
204d18 |
g_variant_new()
|
|
|
204d18 |
|
|
|
204d18 |
The crash was most likely observed when a device running Plex Media
|
|
|
204d18 |
Server was present on the network.
|
|
|
204d18 |
|
|
|
204d18 |
This commit moves the call of g_variant_builder_end() in
|
|
|
204d18 |
prv_system_update_id_for_props_cb() (which invalidates the
|
|
|
204d18 |
GVariantBuilder used later in prv_get_sleeping_for_props()) to the
|
|
|
204d18 |
error handling branch. This leaves the GVariantBuilder alone and
|
|
|
204d18 |
allows prv_get_sr_token_for_props() or one of its descendants to call
|
|
|
204d18 |
g_variant_builder_end() and complete the task.
|
|
|
204d18 |
---
|
|
|
204d18 |
libdleyna/server/device.c | 5 ++---
|
|
|
204d18 |
1 file changed, 2 insertions(+), 3 deletions(-)
|
|
|
204d18 |
|
|
|
204d18 |
diff --git a/libdleyna/server/device.c b/libdleyna/server/device.c
|
|
|
204d18 |
index d77dfbc2725b..8777da0ea2db 100644
|
|
|
204d18 |
--- a/libdleyna/server/device.c
|
|
|
204d18 |
+++ b/libdleyna/server/device.c
|
|
|
204d18 |
@@ -2256,15 +2256,14 @@ static void prv_system_update_id_for_props_cb(GUPnPServiceProxy *proxy,
|
|
|
204d18 |
DLS_SYSTEM_UPDATE_VAR,
|
|
|
204d18 |
g_variant_new_uint32(id));
|
|
|
204d18 |
|
|
|
204d18 |
- cb_data->task.result = g_variant_ref_sink(g_variant_builder_end(
|
|
|
204d18 |
- cb_task_data->vb));
|
|
|
204d18 |
-
|
|
|
204d18 |
on_complete:
|
|
|
204d18 |
|
|
|
204d18 |
if (!cb_data->error)
|
|
|
204d18 |
prv_get_sr_token_for_props(proxy, cb_data->task.target.device,
|
|
|
204d18 |
cb_data);
|
|
|
204d18 |
else {
|
|
|
204d18 |
+ cb_data->task.result = g_variant_ref_sink(g_variant_builder_end(
|
|
|
204d18 |
+ cb_task_data->vb));
|
|
|
204d18 |
(void) g_idle_add(dls_async_task_complete, cb_data);
|
|
|
204d18 |
g_cancellable_disconnect(cb_data->cancellable,
|
|
|
204d18 |
cb_data->cancel_id);
|
|
|
204d18 |
--
|
|
|
204d18 |
2.28.0
|
|
|
204d18 |
|