From: Jiyong Min Date: Tue, 1 Jun 2021 04:43:06 +0000 (+0900) Subject: Revert "Bug fix. read memory after free" X-Git-Tag: submit/tizen/20210610.063803~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a2a1b1ae40267d783d783377e7e0ffbea14b2604;p=platform%2Fcore%2Fapi%2Fmedia-controller.git Revert "Bug fix. read memory after free" This reverts commit d051edd9b2ce8b58e82f90a5defcc3e1800966cd. --- diff --git a/svc/media_controller_svc.c b/svc/media_controller_svc.c index 753c079..aeafc47 100644 --- a/svc/media_controller_svc.c +++ b/svc/media_controller_svc.c @@ -74,31 +74,6 @@ static int __mc_sys_get_uid(uid_t *uid) return users; } -static int __mc_compare_pid(gconstpointer a, gconstpointer b) -{ - mc_app_data_set_t *_app_data = (mc_app_data_set_t *)a; - int cmp_pid = (int)GPOINTER_TO_INT(b); - - mc_retvm_if(!_app_data, -1, "invalid _app_data"); - - mc_secure_debug("__mc_compare_pid : %d, %d", _app_data->pid, cmp_pid); - - if (_app_data->pid == cmp_pid) - return 0; - - return -1; -} - -static int __mc_compare_cmd(gconstpointer a, gconstpointer b) -{ - char *_cmd_data = (char *)a; - char *cmp_cmd = (char *)b; - - mc_secure_debug("__mc_compare_cmd : %s, %s", _cmd_data, cmp_cmd); - - return g_strcmp0(_cmd_data, cmp_cmd); -} - static void __mc_destroy_queue(gpointer data) { mc_service_request *req = (mc_service_request *)data; @@ -152,7 +127,7 @@ static void __mc_remove_cmd_to_send(gpointer data, gpointer user_data) { mc_app_data_set_t *_app_data = (mc_app_data_set_t *)data; mc_list_user_data *_user_data = (mc_list_user_data *)user_data; - GList *found_cmd = NULL; + GList *iter = NULL; mc_retm_if_failed(_app_data); mc_retm_if_failed(_user_data); @@ -160,12 +135,15 @@ static void __mc_remove_cmd_to_send(gpointer data, gpointer user_data) mc_retm_if_failed(_user_data->message->msg_size); mc_retm_if_failed(MC_STRING_VALID(_user_data->message->msg)); - while ((found_cmd = g_list_find_custom(_app_data->cmds_to_send, (gconstpointer)_user_data->message->msg, - __mc_compare_cmd)) != NULL) { - mc_info("remove cmd: %s", (char *)(found_cmd->data)); - _app_data->cmds_to_send = g_list_remove_link(_app_data->cmds_to_send, found_cmd); - g_list_free_full(found_cmd, g_free); - _user_data->result++; + for (iter = _app_data->cmds_to_send; iter; iter = g_list_next(iter)) { + if (!iter->data) + continue; + + if (!g_strcmp0(iter->data, _user_data->message->msg)) { + _app_data->cmds_to_send = g_list_remove_link(_app_data->cmds_to_send, iter); + g_list_free_full(iter, g_free); + _user_data->result++; + } } } @@ -419,7 +397,7 @@ static void __mc_service_remove_connection(GList **connected_list, mc_comm_msg_s mc_debug_fenter(); - item_found = g_list_find_custom(*connected_list, (gconstpointer)request_msg, __find_func); + item_found = g_list_find_custom(*connected_list, (gpointer)request_msg, __find_func); mc_retm_if(!item_found, "Already disconnected pid[%d] priv_type[%d]", request_msg->pid, request_msg->priv_type); *connected_list = g_list_remove_link(*connected_list, item_found); @@ -496,42 +474,37 @@ static int __mc_notify_server_updated(const char *server_name, mc_server_state_e return MEDIA_CONTROLLER_ERROR_NONE; } -static void __mc_destroy_connected_apps_after_noti(gpointer data) -{ - mc_app_data_set_t *_app_data = (mc_app_data_set_t *)data; - - mc_retm_if(!data, "invalid data!"); - - mc_info("app_dead(appid) : %s", _app_data->app_id); - - /* Delete and update information of dead application on database */ - if (mc_db_remove_application(_app_data->uid, _app_data->app_id, _app_data->priv_type) != MEDIA_CONTROLLER_ERROR_NONE) - mc_error("Fail to remove dead application"); - - /* Sends notification for deactivated server via dbus */ - if (_app_data->priv_type == MC_PRIV_TYPE_SERVER) { - if (MEDIA_CONTROLLER_ERROR_NONE != __mc_notify_server_updated(_app_data->app_id, MC_SERVER_STATE_DEACTIVATE)) - mc_error("Fail to notify deactivated server"); - } - - mc_error("[No-error] decreased connection count [%d] pid[%d] priv_type[%d]", - --g_connection_cnt, _app_data->pid, _app_data->priv_type); - __mc_destroy_connected_apps(_app_data); -} - static int __mc_service_app_dead_handler(int pid, void *data) { mc_service_t *_service_data = (mc_service_t *)data; - GList *found_app = NULL; + GList *iter = NULL; + mc_app_data_set_t *_app_data = NULL; mc_info("Received app_dead signal (pid : %d)", pid); mc_retvm_if(!_service_data, AUL_R_ERROR, "data is null!"); mc_retvm_if(!_service_data->connected_apps, AUL_R_OK, "No connected application!"); - while ((found_app = g_list_find_custom(_service_data->connected_apps, (gconstpointer)GINT_TO_POINTER(pid), - __mc_compare_pid)) != NULL) { - _service_data->connected_apps = g_list_remove_link(_service_data->connected_apps, found_app); - g_list_free_full(found_app, __mc_destroy_connected_apps_after_noti); + for (iter = _service_data->connected_apps; iter; iter = g_list_next(iter)) { + _app_data = (mc_app_data_set_t *)iter->data; + + if ((!_app_data) || (_app_data->pid != pid)) + continue; + + mc_secure_debug("app_dead(appid) : %s", _app_data->app_id); + + /* Delete and update information of dead application on database */ + if (MEDIA_CONTROLLER_ERROR_NONE != mc_db_remove_application(_app_data->uid, _app_data->app_id, _app_data->priv_type)) + mc_error("Fail to remove dead application"); + + /* Sends notification for deactivated server via dbus */ + if (_app_data->priv_type == MC_PRIV_TYPE_SERVER) { + if (MEDIA_CONTROLLER_ERROR_NONE != __mc_notify_server_updated(_app_data->app_id, MC_SERVER_STATE_DEACTIVATE)) + mc_error("Fail to notify deactivated server"); + } + + _service_data->connected_apps = g_list_remove_link(_service_data->connected_apps, iter); + g_list_free_full(iter, __mc_destroy_connected_apps); + mc_error("[No-error] decreased connection count [%d] pid[%d] priv_type[%d]", --g_connection_cnt, _app_data->pid, _app_data->priv_type); } return AUL_R_OK;