Fix use after free

When settng the priority to the GSource, it makes the use-after-free issue.
Because, the GSource can attach to the event loop of the sub thread.
This patch removes calling g_source_set_priority() function after
calling g_source_attach().

Change-Id: Iaf9822561e44c08fb96d921b7f7ea9311c45886c
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

diff --git a/src/rpc-port/accepted-port-internal.cc b/src/rpc-port/accepted-port-internal.cc
index 838378dabf90e5faa49a27ad53ec9329188cd3bb..f8d2d16389429fd91a25a402cdc76df224405549 100644 (file)
--- a/src/rpc-port/accepted-port-internal.cc
+++ b/src/rpc-port/accepted-port-internal.cc
@@ -67,8 +67,6 @@ void AcceptedPort::Watch() {
     _E("g_unix_fd_source_new() is failed");
     return;
   }  // LCOV_EXCL_STOP
-
-  g_source_set_priority(source_, G_PRIORITY_DEFAULT);
 }
 
 gboolean AcceptedPort::UnixFdSourceFunc(gint fd, GIOCondition cond,

diff --git a/src/rpc-port/message-sending-thread-internal.cc b/src/rpc-port/message-sending-thread-internal.cc
index f18b59b7375f3dac6a062c898c3b2e2445ebb647..fc873a4794c58d3a9698b0ebf251b483cc7a566e 100644 (file)
--- a/src/rpc-port/message-sending-thread-internal.cc
+++ b/src/rpc-port/message-sending-thread-internal.cc
@@ -51,14 +51,14 @@ gboolean MessageSendingThread::NotifyOne(gpointer data) {
 void MessageSendingThread::ThreadLoop() {
   {
     std::unique_lock<std::mutex> lock(mutex_);
-    auto* source = GLib::IdleAdd(context_, NotifyOne, this);
+    auto* source =
+        GLib::IdleAddFull(context_, G_PRIORITY_HIGH, NotifyOne, this);
     if (source == nullptr) {
       _E("Failed to create GSource");
       cond_.notify_one();
       return;
     }
 
-    g_source_set_priority(source, G_PRIORITY_HIGH);
     g_main_context_push_thread_default(context_);
   }
 

diff --git a/src/rpc-port/proxy-internal.cc b/src/rpc-port/proxy-internal.cc
index f7c240d755aed7c0de54b84ab4a710c84162c130..809ab8456cd724600160744bc992e7c14cd2220f 100644 (file)
--- a/src/rpc-port/proxy-internal.cc
+++ b/src/rpc-port/proxy-internal.cc
@@ -351,8 +351,6 @@ void Proxy::SetConnTimer() {
     conn_timer_data_ = nullptr;
     return;
   }  // LCOV_EXCL_STOP
-
-  g_source_set_priority(source, G_PRIORITY_DEFAULT);
 }
 
 void Proxy::UnsetConnTimer() {
@@ -374,15 +372,14 @@ void Proxy::SetIdler() {
   }  // LCOV_EXCL_STOP
 
   idler_data_ = CreateWeakPtr();
-  GSource* source = GLib::IdleAdd(context_, OnIdle, idler_data_);
+  GSource* source =
+      GLib::IdleAddFull(context_, G_PRIORITY_DEFAULT, OnIdle, idler_data_);
   if (source == nullptr) {  // LCOV_EXCL_START
     _E("g_idle_source_new() is failed");
     DestroyWeakPtr(idler_data_);
     idler_data_ = nullptr;
     return;
   }  // LCOV_EXCL_STOP
-
-  g_source_set_priority(source, G_PRIORITY_DEFAULT);
 }
 
 void Proxy::UnsetIdler() {

diff --git a/src/rpc-port/proxy-port-internal.cc b/src/rpc-port/proxy-port-internal.cc
index af5179a79c6834d33c98af87c65d206ed656a454..1bfd5895dda744268f2880ffc9975d3eb6a3113e 100644 (file)
--- a/src/rpc-port/proxy-port-internal.cc
+++ b/src/rpc-port/proxy-port-internal.cc
@@ -48,8 +48,6 @@ void ProxyPort::Watch(int fd) {
     _E("g_unix_fd_source_new() is failed");
     return;
   }  // LCOV_EXCL_STOP
-
-  g_source_set_priority(source_, G_PRIORITY_DEFAULT);
 }
 
 bool ProxyPort::IsDelegate() const { return is_delegate_; }

diff --git a/src/rpc-port/server-internal.cc b/src/rpc-port/server-internal.cc
index 03faa64ccdc912234ed947759cbb9c2a47f44c7c..957d1de0bcb0b225c93efde3b552948c62db85cd 100644 (file)
--- a/src/rpc-port/server-internal.cc
+++ b/src/rpc-port/server-internal.cc
@@ -37,8 +37,6 @@ int Server::Listen() {
     _E("g_unix_fd_source_new() is failed. fd=%d", GetFd());
     return -1;
   }  // LCOV_EXCL_STOP
-
-  g_source_set_priority(source_, G_PRIORITY_DEFAULT);
   return 0;
 }