Dynamically allocate reentrant call closures

Putting reentrant call closures on the stack can be dangerous if set_reply
is called after the caller has timed out and returned, for instance, so better
to dynamically allocate them.  This will hopefully fix some crashes and
hopefully not leak memory.

diff --git a/dbind/dbind.c b/dbind/dbind.c
index ad3495132b6f34c1542f9faee21cde9aa7210397..60b6fbfa42e520750fa6ec4998609bf6f20adafc 100644 (file)
--- a/dbind/dbind.c
+++ b/dbind/dbind.c
@@ -63,34 +63,41 @@ DBusMessage *
 dbind_send_and_allow_reentry (DBusConnection * bus, DBusMessage * message, DBusError *error)
 {
   DBusPendingCall *pending;
-  SpiReentrantCallClosure closure;
+  SpiReentrantCallClosure *closure;
   const char *unique_name = dbus_bus_get_unique_name (bus);
   const char *destination = dbus_message_get_destination (message);
   struct timeval tv;
+  DBusMessage *ret;
 
   if (unique_name && destination &&
       strcmp (destination, unique_name) != 0)
     return dbus_connection_send_with_reply_and_block (bus, message, dbind_timeout, error);
 
-  closure.reply = NULL;
+  closure = g_new0 (SpiReentrantCallClosure, 1);
+  closure->reply = NULL;
   atspi_dbus_connection_setup_with_g_main(bus, NULL);
   if (!dbus_connection_send_with_reply (bus, message, &pending, dbind_timeout))
       return NULL;
   if (!pending)
     return NULL;
-  dbus_pending_call_set_notify (pending, set_reply, (void *) &closure, NULL);
+  dbus_pending_call_set_notify (pending, set_reply, (void *) closure, g_free);
 
-  closure.reply = NULL;
+  closure->reply = NULL;
   gettimeofday (&tv, NULL);
-  while (!closure.reply)
+  dbus_pending_call_ref (pending);
+  while (!closure->reply)
     {
-      if (!dbus_connection_read_write_dispatch (bus, dbind_timeout))
-        return NULL;
-if (time_elapsed (&tv) > dbind_timeout)
-        return NULL;
+      if (!dbus_connection_read_write_dispatch (bus, dbind_timeout) ||
+          time_elapsed (&tv) > dbind_timeout)
+        {
+          dbus_pending_call_unref (pending);
+          return NULL;
+        }
     }
   
-  return closure.reply;
+  ret = closure->reply;
+  dbus_pending_call_unref (pending);
+  return ret;
 }
 
 dbus_bool_t