From: Johan Hedberg <johan.hedberg@nokia.com>
Date: Thu, 9 Dec 2010 19:52:54 +0000 (+0200)
Subject: gdbus: fix accessing freed callback data
X-Git-Tag: 2.0_alpha~2028
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=4abf29afdfd527c3ddd450972cf0bf6d4e823f09;p=framework%2Fconnectivity%2Fconnman.git

gdbus: fix accessing freed callback data

cb->disc_func or cb->conn_func could remove the callback so this needs
to be checked for before continuing processing.
---

diff --git a/gdbus/watch.c b/gdbus/watch.c
index e7c203a..9cb7ec7 100644
--- a/gdbus/watch.c
+++ b/gdbus/watch.c
@@ -477,6 +477,11 @@ static DBusHandlerResult service_filter(DBusConnection *connection,
 				cb->conn_func(connection, cb->user_data);
 		}
 
+		/* Check if the watch was removed/freed by the callback
+		 * function */
+		if (!g_slist_find(data->callbacks, cb))
+			continue;
+
 		/* Only auto remove if it is a bus name watch */
 		if (data->argument[0] == ':' &&
 				(cb->conn_func == NULL || cb->disc_func == NULL)) {
@@ -484,11 +489,6 @@ static DBusHandlerResult service_filter(DBusConnection *connection,
 			continue;
 		}
 
-		/* Check if the watch was removed/freed by the callback
-		 * function */
-		if (!g_slist_find(data->callbacks, cb))
-			continue;
-
 		data->callbacks = g_slist_remove(data->callbacks, cb);
 		data->processed = g_slist_append(data->processed, cb);
 	}