Fixed crash due to double free.

g_dbus_proxy_call or g_dbus_method_invocation free the gvariant
input parameter in the function.

Change-Id: Id46bef23abb05c2658a20cfd33bb09f1536dd684
Signed-off-by: saerome.kim <saerome.kim@samsung.com>

diff --git a/ua-api/src/ua-request-sender.c b/ua-api/src/ua-request-sender.c
index 146043c..a990eb6 100644 (file)
--- a/ua-api/src/ua-request-sender.c
+++ b/ua-api/src/ua-request-sender.c
@@ -171,14 +171,15 @@ int _uam_sync_request(
        FUNC_ENTRY;
        int result = UAM_ERROR_NONE;
        gint timeout;
-       GDBusProxy *proxy;
-       GVariant *ret;
-       GVariant *param1;
-       GVariant *param2;
-       GVariant *param3;
-       GVariant *param4;
-       GVariant *input_param;
-       GVariant *result_param;
+       GDBusProxy *proxy = NULL;
+       GVariant *ret = NULL;
+       GVariant *param1 = NULL;
+       GVariant *param2 = NULL;
+       GVariant *param3 = NULL;
+       GVariant *param4 = NULL;
+
+       GVariant *input_param = NULL;
+       GVariant *result_param = NULL;
        GError *error = NULL;
 
        UAM_INFO_C("Request function : %s (0x%x)",
@@ -208,14 +209,19 @@ int _uam_sync_request(
        input_param = g_variant_new("(i@ay@ay@ay@ay)", req_func, param1,
                param2, param3, param4);
 
-       g_variant_unref(param1);
-       g_variant_unref(param2);
-       g_variant_unref(param3);
-       g_variant_unref(param4);
-
        ret = g_dbus_proxy_call_sync(proxy, "uam_request",
                        input_param, G_DBUS_CALL_FLAGS_NONE, timeout,
                        NULL, &error);
+       /*
+        * Note: params1~4 and in_params are unreferenced within the g_dbus_proxy_call_sync function.
+        *
+        * ------------------------------------------------------------------------------
+        * Call flow:
+        *  g_dbus_proxy_call_sync_internal -> g_dbus_connection_call_sync ->
+        *  g_dbus_connection_call_sync_internal -> g_dbus_message_set_body  ->
+        *  g_variant_unref(message->body);
+        * ------------------------------------------------------------------------------
+        */
        if (!ret) {
                UAM_ERR("dBUS-RPC failed");
                if (error != NULL) {
@@ -280,6 +286,7 @@ static void __uam_async_request_cb(
                        out_param = g_array_new(TRUE, TRUE, sizeof(gchar));
                        __uam_fill_garray_from_variant(param1, out_param);
                        g_variant_unref(param1);
+                       g_array_unref(out_param);
                }
 
                /* Callback should be invoked only in case of failure */
@@ -303,7 +310,7 @@ static void __uam_async_request_cb(
 
 done:
        if (out_param)
-               g_array_free(out_param, TRUE);
+               g_array_unref(out_param);
 
        if (req_info) {
                pending_requests = g_slist_remove(
@@ -329,11 +336,11 @@ int _uam_async_request(
        uam_req_info_t *req_info;
        gint timeout = -1;
        GDBusProxy *proxy;
-       GVariant *param1;
-       GVariant *param2;
-       GVariant *param3;
-       GVariant *param4;
-       GVariant *input_param;
+       GVariant *param1 = NULL;
+       GVariant *param2 = NULL;
+       GVariant *param3 = NULL;
+       GVariant *param4 = NULL;
+       GVariant *input_param = NULL;
 
        UAM_INFO_C("Request function : %s (0x%x)",
                        _uam_request_to_str(req_func), req_func);
@@ -362,19 +369,24 @@ int _uam_async_request(
        input_param = g_variant_new("(i@ay@ay@ay@ay)", req_func, param1,
                param2, param3, param4);
 
-       g_variant_unref(param1);
-       g_variant_unref(param2);
-       g_variant_unref(param3);
-       g_variant_unref(param4);
-
        g_dbus_proxy_call(proxy, "uam_request",
                        input_param,
                        G_DBUS_CALL_FLAGS_NONE,
                        timeout, NULL,
                        __uam_async_request_cb, req_info);
+       /*
+        * Note: In_params is unreferenced within the g_dbus_proxy_call_sync function.
+        *
+        * ------------------------------------------------------------------------------
+        * Call flow:
+        *  g_dbus_proxy_call_sync_internal -> g_dbus_connection_call_sync ->
+        *  g_dbus_connection_call_sync_internal -> g_dbus_message_set_body  ->
+        *  g_variant_unref(message->body);
+        * ------------------------------------------------------------------------------
+        */
 
        pending_requests = g_slist_append(pending_requests, req_info);
 
        FUNC_EXIT;
        return result;
-}
+}
\ No newline at end of file

diff --git a/ua-daemon/src/ua-manager-common.c b/ua-daemon/src/ua-manager-common.c
old mode 100755 (executable)
new mode 100644 (file)
index 9d3fe98..b7a5136
--- a/ua-daemon/src/ua-manager-common.c
+++ b/ua-daemon/src/ua-manager-common.c
@@ -141,13 +141,12 @@ void _uam_manager_method_return(
                GDBusMethodInvocation *invocation, GArray *out_param, int result)
 {
        FUNC_ENTRY;
-       GVariant *out_var;
-       GVariant *return_var;
+       GVariant *out_var = NULL;
+       GVariant *return_var = NULL;
        out_var = g_variant_new_from_data((const GVariantType *)"ay",
                        out_param->data, out_param->len, TRUE, NULL, NULL);
 
        return_var = g_variant_new("(iv)", result, out_var);
-       g_variant_unref(out_var);
 
        g_dbus_method_invocation_return_value(invocation, return_var);
 
@@ -206,4 +205,3 @@ const char *_uam_get_sensor_str(uas_plugin_id_e ids)
                return "UNKNOWN SENSOR";
        }
 }
-