From e48f48733c74ad6c6d1310b08321c1e03eb3d375 Mon Sep 17 00:00:00 2001 From: Junseok Kim Date: Fri, 13 May 2022 12:34:49 +0900 Subject: [PATCH] e_policy_wl: added ref/unref of E_Client when tzsh_service add/del There was a use after free bug to access freed e_client. When the E_Client deleted before the tzsh_service destroyed by request from client, It could occure the "Use After Free" issue to the E_Client object. For fix this problem, added e_object_ref/unref of E_Client to tzsh_service add and del Change-Id: I1eecb42d5afa700c95f020336dc73c488449cbc5 --- src/bin/e_policy_wl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/bin/e_policy_wl.c b/src/bin/e_policy_wl.c index e2c340585e..1277ad8e37 100644 --- a/src/bin/e_policy_wl.c +++ b/src/bin/e_policy_wl.c @@ -629,6 +629,7 @@ _e_policy_wl_tzsh_srv_add(E_Policy_Wl_Tzsh *tzsh, Tzsh_Srv_Role role, struct wl_ tzsh_srv->name = eina_stringshare_add(name); tzsh_srv->ep = ep; tzsh_srv->ec = ec; + e_object_ref(E_OBJECT(ec)); tzsh_srv->tzsh->service_list = eina_list_append(tzsh_srv->tzsh->service_list, tzsh_srv); polwl->srvs[role] = tzsh_srv; @@ -708,6 +709,11 @@ _e_policy_wl_tzsh_srv_del(E_Policy_Wl_Tzsh_Srv *tzsh_srv) } } + if (tzsh_srv->ec) + { + e_object_unref(E_OBJECT(tzsh_srv->ec)); + tzsh_srv->ec = NULL; + } memset(tzsh_srv, 0x0, sizeof(E_Policy_Wl_Tzsh_Srv)); E_FREE(tzsh_srv); } -- 2.34.1