Add g_steal_pointer to avoid double-free 32/311532/1 tizen
authorsooyeon <sooyeon.kim@samsung.com>
Mon, 15 Apr 2024 07:34:36 +0000 (16:34 +0900)
committerSooyeon Kim <sooyeon.kim@samsung.com>
Wed, 22 May 2024 06:48:23 +0000 (06:48 +0000)
Change-Id: I9e755e7fd34f2f3b426303683833707a07a899fd
Signed-off-by: sooyeon <sooyeon.kim@samsung.com>
(cherry picked from commit 1f94e6693848154ae8d802215cb927584853b59d)

client/tts_tidl.c

index 17ecfef..31f0be6 100644 (file)
@@ -159,6 +159,7 @@ static void __notify_cb(void *user_data, int pid, int uid, bundle *msg)
 static void destroy_scheduled_handle(gpointer data)
 {
        rpc_port_proxy_tts_h rpc_h = (rpc_port_proxy_tts_h)data;
+       SLOG(LOG_WARN, TAG_TTSC, "[WARNING] Destroy rpc handle(%p)", rpc_h);
        int ret = rpc_port_proxy_tts_destroy(rpc_h);
        if (RPC_PORT_ERROR_NONE != ret) {
                SLOG(LOG_ERROR, TAG_TTSC, "[ERROR] Fail to destroy handle. ret(%d/%s)", ret, get_error_message(ret));
@@ -168,7 +169,7 @@ static void destroy_scheduled_handle(gpointer data)
 static Eina_Bool destroy_scheduled_handles_by_ecore_idler(void *user_data)
 {
        SLOG(LOG_INFO, TAG_TTSC, "[INFO] Destroy RPC handles those are scheduled to be destroyed.");
-       g_slist_free_full(g_destruction_scheduled_handles, destroy_scheduled_handle);
+       g_slist_free_full(g_steal_pointer(&g_destruction_scheduled_handles), destroy_scheduled_handle);
        g_destruction_scheduled_handles = NULL;
        g_destroy_handles_idler = NULL;
 
@@ -301,7 +302,7 @@ int tts_tidl_close_connection(unsigned int uid)
                g_destroy_handles_idler = NULL;
        }
 
-       g_slist_free_full(g_destruction_scheduled_handles, destroy_scheduled_handle);
+       g_slist_free_full(g_steal_pointer(&g_destruction_scheduled_handles), destroy_scheduled_handle);
        g_destruction_scheduled_handles = NULL;
 
        free(info->engine_app_id);