Fix screen_connector_watcher_remove API bug

Widget app died after screen watcher handle freed,
viewer crashed because of freed data.

Change-Id: I7aef5e6b6b2dcf09cb2bdd04c7d38d016dedc936
Signed-off-by: Hyunho Kang <hhstark.kang@samsung.com>

diff --git a/screen_connector_watcher/src/screen_connector_watcher.c b/screen_connector_watcher/src/screen_connector_watcher.c
index 78cf107..ad29f4e 100644 (file)
--- a/screen_connector_watcher/src/screen_connector_watcher.c
+++ b/screen_connector_watcher/src/screen_connector_watcher.c
@@ -250,8 +250,15 @@ static void __destroy_watcher_h(screen_connector_watcher_h handle)
        if (!handle)
                return;
 
-       if (handle->appid)
+       tizen_remote_surface_set_user_data(handle->surface, NULL);
+       tizen_remote_surface_unredirect(handle->surface);
+       tizen_remote_surface_destroy(handle->surface);
+       handle->surface = NULL;
+
+       if (handle->appid) {
                free(handle->appid);
+               handle->appid = NULL;
+       }
 
        free(handle);
 }
@@ -308,6 +315,10 @@ EXPORT_API screen_connector_watcher_h screen_connector_watcher_add(screen_connec
 
 EXPORT_API int screen_connector_watcher_remove(screen_connector_watcher_h h)
 {
+       if (h == NULL) {
+               LOGE("screen_connector_watcher_h is NULL");
+               return -1;
+       }
        __destroy_watcher_h(h);
 
        return 0;

diff --git a/screen_connector_watcher_evas/src/screen_connector_watcher_evas.c b/screen_connector_watcher_evas/src/screen_connector_watcher_evas.c
index b7803f4..5966e2b 100644 (file)
--- a/screen_connector_watcher_evas/src/screen_connector_watcher_evas.c
+++ b/screen_connector_watcher_evas/src/screen_connector_watcher_evas.c
@@ -50,15 +50,6 @@ static Evas_Object *__viewer_win;
 static Ecore_Event_Handler *__visibility_listener;
 static GHashTable *__watcher_tbl;
 
-static void __destroy_watcher_evas_handle(screen_connector_watcher_evas_h h)
-{
-       if (!h)
-               return;
-       free(h->ops);
-       free(h);
-       h = NULL;
-}
-
 EXPORT_API int screen_connector_watcher_evas_init(Evas_Object *win)
 {
        __viewer_win = win;
@@ -179,6 +170,11 @@ static void __rs_cb_mouse_down(void *data, Evas *e, Evas_Object *obj, void *even
        }
 
        surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+       if (surface == NULL) {
+               LOGE("surface is NULL");
+               return;
+       }
+
        tizen_remote_surface_transfer_mouse_event(surface,
                        TIZEN_REMOTE_SURFACE_EVENT_TYPE_MOUSE_DOWN,
                        0,
@@ -220,6 +216,11 @@ static void __rs_cb_mouse_up(void *data, Evas *e, Evas_Object *obj, void *event_
        }
 
        surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+       if (surface == NULL) {
+               LOGE("surface is NULL");
+               return;
+       }
+
        tizen_remote_surface_transfer_mouse_event(surface,
                        TIZEN_REMOTE_SURFACE_EVENT_TYPE_MOUSE_UP,
                        0,
@@ -261,6 +262,11 @@ static void __rs_cb_mouse_move(void *data, Evas *e, Evas_Object *obj, void *even
        }
 
        surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+       if (surface == NULL) {
+               LOGE("surface is NULL");
+               return;
+       }
+
        tizen_remote_surface_transfer_mouse_event(surface,
                        TIZEN_REMOTE_SURFACE_EVENT_TYPE_MOUSE_MOVE,
                        0,
@@ -296,6 +302,11 @@ static void __rs_cb_mouse_wheel(void *data, Evas *e, Evas_Object *obj, void *eve
        }
 
        surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+       if (surface == NULL) {
+               LOGE("surface is NULL");
+               return;
+       }
+
        tizen_remote_surface_transfer_mouse_wheel(surface,
                        ev->direction,
                        ev->z,
@@ -483,8 +494,10 @@ static void __free_watcher_evas_h(screen_connector_watcher_evas_h watcher_evas_h
                watcher_evas_h->img_tbm = NULL;
        }
 
-       if (watcher_evas_h->ops)
+       if (watcher_evas_h->ops) {
                free(watcher_evas_h->ops);
+               watcher_evas_h->ops = NULL;
+       }
 
        free(watcher_evas_h);
 }
@@ -515,6 +528,7 @@ static void __watcher_missing_cb(struct tizen_remote_surface *trs, void *data)
                watcher_evas_h->ops->removed(appid, watcher_evas_h->img_tbm, watcher_evas_h->data);
        else
                watcher_evas_h->ops->removed(appid, watcher_evas_h->img_file, watcher_evas_h->data);
+
        __free_watcher_evas_h(watcher_evas_h);
 }
 
@@ -551,11 +565,11 @@ EXPORT_API screen_connector_watcher_evas_h screen_connector_watcher_evas_add(scr
 
 EXPORT_API int screen_connector_watcher_evas_remove(screen_connector_watcher_evas_h handle)
 {
-       int ret;
+       if (handle == NULL)
+               return -1;
 
-       ret = screen_connector_watcher_remove(handle->watcher_h);
-       __destroy_watcher_evas_handle(handle);
-       return ret;
+       __free_watcher_evas_h(handle);
+       return 0;
 }
 
 EXPORT_API int screen_connector_watcher_evas_update(const char *appid)
@@ -674,6 +688,11 @@ EXPORT_API int screen_connector_watcher_evas_send_mouse_up(Evas_Object *obj)
        }
 
        surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+       if (surface == NULL) {
+               LOGE("surface is NULL");
+               return -1;
+       }
+
        evas_object_geometry_get(obj, &x, &y, &w, &h);
        timestamp = (unsigned int)((unsigned long long)(ecore_time_get() * 1000.0) & 0xffffffff);
        tizen_remote_surface_transfer_mouse_event(surface,
@@ -707,6 +726,11 @@ EXPORT_API int screen_connector_watcher_evas_send_touch_cancel(Evas_Object *obj)
 
        if (watcher_evas_h->img_tbm) {
                surface = screen_connector_watcher_get_trs(watcher_evas_h->watcher_h);
+               if (surface == NULL) {
+                       LOGE("surface is NULL");
+                       return -1;
+               }
+
                tizen_remote_surface_transfer_touch_cancel(surface);
                watcher_evas_h->cancel_touch = true;
        } else {