From: sooyeon <sooyeon.kim@samsung.com>
Date: Fri, 13 Sep 2024 12:34:12 +0000 (+0900)
Subject: Add a null checker inside __initialize_tidl_info
X-Git-Tag: accepted/tizen/8.0/unified/20241011.164854~2
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=02f80cd9787a9e26fe0e64eb092dc6cf3a31a977;p=platform%2Fcore%2Fuifw%2Ftts.git

Add a null checker inside __initialize_tidl_info

- Issue:
Double-free issue was occurred inside __initialize_tidl_info

- Solution:
To avoid doing unnecessary free() inside __initialize_tidl_info(), we added a null checker for rpc handle.

Change-Id: Iedfdcd1216acd6749d531a251a08f0790239f6e6
Signed-off-by: sooyeon <sooyeon.kim@samsung.com>
---

diff --git a/client/tts_tidl.c b/client/tts_tidl.c
index b8b8518c..e3c16b68 100644
--- a/client/tts_tidl.c
+++ b/client/tts_tidl.c
@@ -164,7 +164,7 @@ static void destroy_scheduled_handle(gpointer data)
 {
 	pthread_mutex_lock(&g_rpc_h_mutex);
 	rpc_port_proxy_tts_h rpc_h = (rpc_port_proxy_tts_h)data;
-	SLOG(LOG_WARN, TAG_TTSC, "[WARNING] Destroy rpc handle(%p)", rpc_h);
+	SLOG(LOG_ERROR, TAG_TTSC, "[WARNING] Destroy rpc handle(%p)", rpc_h);
 	int ret = rpc_port_proxy_tts_destroy(rpc_h);
 	if (RPC_PORT_ERROR_NONE != ret) {
 		SLOG(LOG_ERROR, TAG_TTSC, "[ERROR] Fail to destroy handle. ret(%d/%s)", ret, get_error_message(ret));
@@ -174,7 +174,7 @@ static void destroy_scheduled_handle(gpointer data)
 
 static Eina_Bool destroy_scheduled_handles_by_ecore_idler(void *user_data)
 {
-	SLOG(LOG_INFO, TAG_TTSC, "[INFO] Destroy RPC handles those are scheduled to be destroyed.");
+	SLOG(LOG_ERROR, TAG_TTSC, "[INFO] Destroy RPC handles those are scheduled to be destroyed.");
 	g_slist_free_full(g_steal_pointer(&g_destruction_scheduled_handles), destroy_scheduled_handle);
 	g_destruction_scheduled_handles = NULL;
 	g_destroy_handles_idler = NULL;
@@ -184,11 +184,22 @@ static Eina_Bool destroy_scheduled_handles_by_ecore_idler(void *user_data)
 
 static void __initialize_tidl_info(tts_tidl_info_s* info)
 {
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] __initialize_tidl_info START");
+
 	if (NULL == info) {
 		SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] Invalid parameter");
 		return ;
 	}
 
+	pthread_mutex_lock(&g_rpc_h_mutex);
+	if (NULL == info->rpc_h) {
+		SLOG(LOG_WARN, TAG_TTSC, "[TIDL] Handle is already destroyed");
+		pthread_mutex_unlock(&g_rpc_h_mutex);
+		return ;
+	}
+
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] initialize info parameters");
+
 	info->rpc_h = NULL;
 	info->notify_cb_h = NULL;
 
@@ -198,30 +209,40 @@ static void __initialize_tidl_info(tts_tidl_info_s* info)
 	info->register_callback_invoked = false;
 	info->connected = false;
 	info->connection_requesting = false;
+
+	pthread_mutex_unlock(&g_rpc_h_mutex);
+
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] __initialize_tidl_info is DONE");
 }
 
 static inline void destroy_rpc_port(tts_tidl_info_s* info)
 {
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] destroy_rpc_port START");
+
 	pthread_mutex_lock(&g_rpc_h_mutex);
 	if (NULL == info->rpc_h) {
-		SLOG(LOG_WARN, TAG_TTSC, "[TIDL] Handle is already destroyed");
+		SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] Handle is already destroyed");
 		pthread_mutex_unlock(&g_rpc_h_mutex);
 		return ;
 	}
 	if (true == info->destruction_requesting) {
-		SLOG(LOG_WARN, TAG_TTSC, "[TIDL] Destroying rpc port is already requested");
+		SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] Destroying rpc port is already requested");
 		pthread_mutex_unlock(&g_rpc_h_mutex);
 		return ;
 	}
 
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] Add rpc handle to destroy");
+
 	g_destruction_scheduled_handles = g_slist_append(g_destruction_scheduled_handles, info->rpc_h);
 	if (NULL == g_destroy_handles_idler) {
+		SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] Add ecore idler to destroy rpc handles");
 		g_destroy_handles_idler = ecore_idler_add(destroy_scheduled_handles_by_ecore_idler, NULL);
 	}
 
 	info->destruction_requesting = true;
 
 	pthread_mutex_unlock(&g_rpc_h_mutex);
+	SLOG(LOG_ERROR, TAG_TTSC, "[TIDL] destroy_rpc_port is DONE");
 }
 
 static void __on_connected(rpc_port_proxy_tts_h h, void *user_data)