e_policy_wl: added ref/unref of E_Client when tzsh_service add/del

There was a use after free bug to access freed e_client.

When the E_Client deleted before the tzsh_service destroyed by request from client,
It could occure the "Use After Free" issue to the E_Client object.

For fix this problem, added e_object_ref/unref of E_Client to tzsh_service add and del

Change-Id: I1eecb42d5afa700c95f020336dc73c488449cbc5

diff --git a/src/bin/e_policy_wl.c b/src/bin/e_policy_wl.c
index e2c340585eded53d916c6d8424b1407d1e0fcd81..1277ad8e3795fb38eff10297aee1855f4f01caac 100644 (file)
--- a/src/bin/e_policy_wl.c
+++ b/src/bin/e_policy_wl.c
@@ -629,6 +629,7 @@ _e_policy_wl_tzsh_srv_add(E_Policy_Wl_Tzsh *tzsh, Tzsh_Srv_Role role, struct wl_
    tzsh_srv->name = eina_stringshare_add(name);
    tzsh_srv->ep = ep;
    tzsh_srv->ec = ec;
+   e_object_ref(E_OBJECT(ec));
    tzsh_srv->tzsh->service_list = eina_list_append(tzsh_srv->tzsh->service_list, tzsh_srv);
 
    polwl->srvs[role] = tzsh_srv;
@@ -708,6 +709,11 @@ _e_policy_wl_tzsh_srv_del(E_Policy_Wl_Tzsh_Srv *tzsh_srv)
           }
      }
 
+   if (tzsh_srv->ec)
+     {
+       e_object_unref(E_OBJECT(tzsh_srv->ec));
+       tzsh_srv->ec = NULL;
+     }
    memset(tzsh_srv, 0x0, sizeof(E_Policy_Wl_Tzsh_Srv));
    E_FREE(tzsh_srv);
 }