Fix invalid access

The reply callback can be invoked before the result callback is invoked.

Change-Id: I119be2009af90d60727dcf24965be87c6361d261
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

diff --git a/src/launch_with_result.c b/src/launch_with_result.c
index 24001f0..71c665c 100644 (file)
--- a/src/launch_with_result.c
+++ b/src/launch_with_result.c
@@ -210,11 +210,15 @@ static int __call_app_result_callback(bundle *kb, int is_cancel,
                if (new_info)
                        __add_resultcb(new_info);
 
-               if (info->caller_cb)
+               if (info->caller_cb) {
                        info->caller_cb(launched_pid, info->caller_data);
+                       info->caller_cb = NULL;
+               }
 
-               __remove_resultcb(info);
-               __destroy_resultcb(info);
+               if (!info->error_cb) {
+                       __remove_resultcb(info);
+                       __destroy_resultcb(info);
+               }
 
                _D("change callback, fwd pid: %d", launched_pid);
 
@@ -222,8 +226,12 @@ static int __call_app_result_callback(bundle *kb, int is_cancel,
        }
 
        info->reply_cb(kb, is_cancel, info->user_data);
-       __remove_resultcb(info);
-       __destroy_resultcb(info);
+       info->reply_cb = NULL;
+
+       if (!info->error_cb) {
+               __remove_resultcb(info);
+               __destroy_resultcb(info);
+       }
 
 end:
        return 0;
@@ -524,7 +532,7 @@ API int aul_subapp_terminate_request_pid(int pid)
        while (iter) {
                info = (app_resultcb_info_t *)iter->data;
                iter = g_list_next(iter);
-               if (info->launched_pid == pid) {
+               if (info->launched_pid == pid && !info->error_cb) {
                        __resultcb_list = g_list_remove(
                                        __resultcb_list, info);
                        __destroy_resultcb(info);

diff --git a/src/service.c b/src/service.c
index 9e3b9a5..37321be 100755 (executable)
--- a/src/service.c
+++ b/src/service.c
@@ -215,11 +215,16 @@ static void __aul_cb(bundle *b, int is_cancel, void *data)
        /* find corresponding callback */
        cb_info = (aul_svc_cb_info_t*)data;
 
-       cb_info->cb_func(b, cb_info->request_code,
-                       (aul_svc_result_val)res, cb_info->data);
-       __remove_rescb(cb_info);
+       if (cb_info->cb_func) {
+               cb_info->cb_func(b, cb_info->request_code,
+                               (aul_svc_result_val)res, cb_info->data);
+               cb_info->cb_func = NULL;
+       }
 
-       return;
+       if (cb_info->err_cb)
+               return;
+
+       __remove_rescb(cb_info);
 }
 
 static int __error_convert(int res)
@@ -256,6 +261,11 @@ static void __aul_error_cb(int err, void *data)
                cb_info->err_cb(cb_info->request_code, err, cb_info->data);
                cb_info->err_cb = NULL;
        }
+
+       if (cb_info->cb_func)
+               return;
+
+       __remove_rescb(cb_info);
 }
 
 static int __run_svc_with_pkgname(char *pkgname, bundle *b, int request_code,