edbus: avoid cyclic unref
authorLucas De Marchi <lucas.demarchi@profusion.mobi>
Thu, 20 Dec 2012 14:52:27 +0000 (14:52 +0000)
committerLucas De Marchi <lucas.demarchi@profusion.mobi>
Thu, 20 Dec 2012 14:52:27 +0000 (14:52 +0000)
commit080dbf972c2985dd2abf5cc1253b9d900df5fc2f
tree119070bd7c02c8feedbeb15e7f4e731ebb3843ea
parent29d42f4f44dc8bf52e4932949972807694dd1c92
edbus: avoid cyclic unref

If we are freeing a EDBUS_Connection_Name its name_owner_changed signal
handler may hold a pointer and try to unref it when deleting the signal
handler. We can't simply make the signal handler hold a reference to the
connection name, otherwise edbus_connection_name_gc will never be
triggered because of cyclic references.

Thus, just set the cn->name_owner_changed->bus to NULL before trying to
delete the signal handler.

Related log found by Lucas Jóia:

==20607== Invalid read of size 4
==20607==    at 0x6FE29EE: edbus_connection_name_gc.isra.3 (edbus_core.c:375)
==20607==    by 0x6FE4287: edbus_connection_unref (edbus_core.c:1028)
==20607==    by 0x4C8D94: e_msgbus_shutdown (e_msgbus.c:167)
==20607==    by 0x436194: _e_main_shutdown (e_main.c:1136)
==20607==    by 0x434F25: main (e_main.c:1074)
==20607==  Address 0x1461ba68 is 24 bytes inside a block of size 64 free'd
==20607==    at 0x4C2A739: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==20607==    by 0x6FF0E78: edbus_signal_handler_unref (edbus_signal_handler.c:269)
==20607==    by 0x6FE2A48: edbus_connection_name_gc.isra.3 (edbus_core.c:384)
==20607==    by 0x6FE4287: edbus_connection_unref (edbus_core.c:1028)
==20607==    by 0x4C8D94: e_msgbus_shutdown (e_msgbus.c:167)
==20607==    by 0x436194: _e_main_shutdown (e_main.c:1136)
==20607==    by 0x434F25: main (e_main.c:1074)

SVN revision: 81463
src/lib/edbus_core.c