Fix the issue of heap-use-after-free

Change-Id: Ibae4f96a5d326bad019c64d37d608f669ae18347

diff --git a/packaging/mm-resource-manager.spec b/packaging/mm-resource-manager.spec
index db29601..1a28e41 100644 (file)
--- a/packaging/mm-resource-manager.spec
+++ b/packaging/mm-resource-manager.spec
@@ -1,6 +1,6 @@
 Name:       mm-resource-manager
 Summary:    A Multimedia Resource Manager API
-Version:    0.2.27
+Version:    0.2.28
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/daemon/mm_resource_manager_daemon_priv.c b/src/daemon/mm_resource_manager_daemon_priv.c
index dadd543..b3cda94 100644 (file)
--- a/src/daemon/mm_resource_manager_daemon_priv.c
+++ b/src/daemon/mm_resource_manager_daemon_priv.c
@@ -93,7 +93,7 @@ static GArray* __handle_acquire_requests(mm_resource_manager_dmn_p manager,
 static void __handle_release_callbacks(GArray *requests);
 static inline void __add_cb_request(GArray *cb_requests, mm_resource_manager_dmn_p mgr,
                mm_resource_manager_res_type_e type, mm_resource_manager_res_volume volume);
-static void __release_all_resources(mm_resource_manager_dmn_s *manager);
+static void __release_all_resources(mm_resource_manager_dmn_p manager);
 static gboolean __poll(struct pollfd sync);
 static gboolean __wait_for_release_cb_sync(mm_resource_manager_id id);
 
@@ -192,16 +192,14 @@ mm_resource_manager_error_e _mmrm_dmn_destroy(mm_resource_manager_id id)
                        "Resource manager #%"PRIu64" doesn't exist", _mm_rm_hash64(id));
        MM_RM_RETVM_IF(conf == NULL, MM_RESOURCE_MANAGER_ERROR_NONE, "conf is null");
 
-       i_mgr = (mm_resource_manager_dmn_p)managers->pdata[idx];
+       type = i_mgr->type;
 
-       __release_all_resources((mm_resource_manager_dmn_s *)managers->pdata[idx]);
+       __release_all_resources(i_mgr);
        mm_resource_manager_backend_commit_all();
 
        g_ptr_array_remove_index_fast(managers, idx);
 
-       type = i_mgr->type;
-
-       MM_RM_INFO("managers length #%d type %d available volume %d", managers->len, type, conf->max_volume[type]);
+       MM_RM_INFO("remaining managers #%d type %d available volume %d", managers->len, type, conf->max_volume[type]);
 
 #ifdef RM_GCOV_TEST
        __gcov_flush();
@@ -742,7 +740,7 @@ static void __handle_release_requests(mm_resource_manager_dmn_p manager,
        }
 }
 
-static void __release_all_resources(mm_resource_manager_dmn_s *manager)
+static void __release_all_resources(mm_resource_manager_dmn_p manager)
 {
        int i, j;