gdbus: fix use-after-free 30/199530/2
authorLars Uebernickel <lars.uebernickel@canonical.com>
Thu, 28 Jan 2016 14:39:18 +0000 (15:39 +0100)
committerHyotaek Shim <hyotaek.shim@samsung.com>
Tue, 26 Feb 2019 02:30:18 +0000 (02:30 +0000)
commitfbafb7059b369a3becd5891c75d6172ae5118ea5
tree7095010f03ef5d9ce56a42c98181971c88d02e76
parentfb227b4711bcecbcbd78d7283b9420ee5d7f56d5
gdbus: fix use-after-free

g_dbus_connection_call_internal() accesses the user data it passes to
g_dbus_connection_send_message_with_reply() after the call. That data
might be freed already in the case that the callback is called
immediately.

Fix this by removing the 'serial' field from the user data altogether
and fetch the serial from the message in the callback.

https://bugzilla.gnome.org/show_bug.cgi?id=748263

Change-Id: I6c6406f4782bbaeb19dad6b4ae08b3375592d3bc
gio/gdbusconnection.c