Fix Bof issue : dbus error handling

Change-Id: I5a6d9e1fe2cdff65fc1dbde0e3e207f57df884ca

diff --git a/packaging/mm-resource-manager.spec b/packaging/mm-resource-manager.spec
index e003b3c..b241ca0 100644 (file)
--- a/packaging/mm-resource-manager.spec
+++ b/packaging/mm-resource-manager.spec
@@ -1,6 +1,6 @@
 Name:       mm-resource-manager
 Summary:    A Multimedia Resource Manager API
-Version:    0.2.23
+Version:    0.2.24
 Release:    0
 Group:      Multimedia/API
 License:    Apache-2.0

diff --git a/src/daemon/backend/mm_resource_manager_backend.c b/src/daemon/backend/mm_resource_manager_backend.c
index da19481..7343c80 100644 (file)
--- a/src/daemon/backend/mm_resource_manager_backend.c
+++ b/src/daemon/backend/mm_resource_manager_backend.c
@@ -86,8 +86,6 @@ int mm_resource_manager_backend_release(mm_resource_manager_res_type_e type)
 
        if (resources[type].ref_counter > 0)
                resources[type].ref_counter--;
-       else
-               MM_RM_WARNING("Reference counter is already 0");
 
        return MM_RESOURCE_MANAGER_ERROR_NONE;
 }

diff --git a/src/daemon/mm_resource_manager_daemon_dbus.c b/src/daemon/mm_resource_manager_daemon_dbus.c
index cd238a9..a89fe89 100755 (executable)
--- a/src/daemon/mm_resource_manager_daemon_dbus.c
+++ b/src/daemon/mm_resource_manager_daemon_dbus.c
@@ -40,6 +40,15 @@ static gboolean on_commit_handle(MMResourceManager *interface,
 static void on_bus_acquired(GDBusConnection *connection, const gchar *name,
                gpointer user_data);
 
+static gboolean _type_is_valid(int type)
+{
+       if ((type != MM_RESOURCE_MANAGER_NO_RES) &&
+               (type < MM_RESOURCE_MANAGER_RES_TYPE_VIDEO_DECODER || type >= MM_RESOURCE_MANAGER_RES_TYPE_MAX))
+               return FALSE;
+
+       return TRUE;
+}
+
 
 static gboolean _create_pid_file(void)
 {
@@ -163,26 +172,42 @@ int _mmrm_dmn_dbus_commit(mm_resource_manager_id id, GVariantIter *release,
 {
        int i;
        int ret;
-       mm_resource_manager_dmn_res_request_s *release_requests = NULL,
-                       *acquire_requests = NULL;
+       mm_resource_manager_res_type_e type;
+       mm_resource_manager_dmn_res_request_s *release_requests = NULL, *acquire_requests = NULL;
+       gsize release_len = 0, acquire_len = 0;
 
        __gv2c_array(release, &release_requests);
-       if (release_requests->type != MM_RESOURCE_MANAGER_NO_RES)
-               MM_RM_DEBUG("Commit release request of %"G_GSIZE_FORMAT" items [type %d]",
-                       g_variant_iter_n_children(release), release_requests->type);
+
+       type = release_requests->type;
+       release_len = g_variant_iter_n_children(release);
+
+       if (!_type_is_valid(type)) {
+               ret = MM_RESOURCE_MANAGER_ERROR_INVALID_PARAMETER;
+               goto out;
+       }
+
+       MM_RM_DEBUG("Commit release request of %"G_GSIZE_FORMAT" items [type %d]", release_len, type);
 
        __gv2c_array(acquire, &acquire_requests);
-       if (acquire_requests->type != MM_RESOURCE_MANAGER_NO_RES)
-               MM_RM_DEBUG("Commit acquire request of %"G_GSIZE_FORMAT" items [type %d]",
-                       g_variant_iter_n_children(acquire), acquire_requests->type);
 
-       *is_acquired = (gboolean *) g_malloc0_n(g_variant_iter_n_children(acquire), sizeof(**is_acquired));
+       type = acquire_requests->type;
+       acquire_len = g_variant_iter_n_children(acquire);
+
+       if (!_type_is_valid(type)) {
+               ret = MM_RESOURCE_MANAGER_ERROR_INVALID_PARAMETER;
+               goto out;
+       }
+
+       MM_RM_DEBUG("Commit acquire request of %"G_GSIZE_FORMAT" items [type %d]", acquire_len, type);
+
+       *is_acquired = (gboolean *) g_malloc0_n(acquire_len, sizeof(**is_acquired));
 
        ret = _mmrm_dmn_commit(id, release_requests, acquire_requests);
 
        for (i = 0; acquire_requests[i].type != MM_RESOURCE_MANAGER_NO_RES; i++)
                (*is_acquired)[i] = acquire_requests[i].priority_error;
 
+out:
        g_free(release_requests);
        g_free(acquire_requests);
 
@@ -218,13 +243,18 @@ void _mmrm_dmn_notify_fork_done(void)
 static void __gv2c_array(GVariantIter *gv, mm_resource_manager_dmn_res_request_s **c)
 {
        int i;
+       mm_resource_manager_res_type_e type;
        mm_resource_manager_dmn_res_request_s *rs;
 
-       rs = (mm_resource_manager_dmn_res_request_s *)
-                       g_malloc0_n(g_variant_iter_n_children(gv), sizeof(*rs));
+       rs = (mm_resource_manager_dmn_res_request_s *)g_malloc0_n(g_variant_iter_n_children(gv), sizeof(*rs));
        for (i = 0; g_variant_iter_next(gv, "(ii)", &rs[i].type, &rs[i].volume); i++) {
-               if (rs[i].type != MM_RESOURCE_MANAGER_NO_RES)
-                       MM_RM_DEBUG("(type, vol) = (%d, %d)", rs[i].type, rs[i].volume);
+               type = rs[i].type;
+               if (!_type_is_valid(type)) {
+                       MM_RM_ERROR("type %d is wrong", type);
+                       break;
+               }
+
+               MM_RM_DEBUG("(type, vol) = (%d, %d)", type, rs[i].volume);
        }
 
        *c = rs;
@@ -310,34 +340,37 @@ static gboolean on_commit_handle(MMResourceManager *interface,
                GVariant *release, GVariant *acquire, gpointer user_data)
 {
        gint error = 0;
-       gboolean *flags;
+       gboolean ret = TRUE, *flags;
        GVariantBuilder *flags_builder;
-       GVariant *not_acquired_flags;
        GVariantIter *release_array;
        GVariantIter *acquire_array;
-       gsize acquire_len;
        gint i;
 
        MM_RM_DEBUG("Receive commit message");
 
        release_array = g_variant_iter_new(release);
        acquire_array = g_variant_iter_new(acquire);
-       acquire_len = g_variant_iter_n_children(acquire_array);
 
        error = _mmrm_dmn_dbus_commit(id, release_array, acquire_array, &flags);
+       if (error != MM_RESOURCE_MANAGER_ERROR_NONE) {
+               MM_RM_ERROR("dbus commit error");
+               ret = FALSE;
+               goto out;
+       }
 
        flags_builder = g_variant_builder_new(G_VARIANT_TYPE_ARRAY);
-       for (i = 0; i < acquire_len; i++)
+       for (i = 0; i < g_variant_iter_n_children(acquire_array); i++)
                g_variant_builder_add_value(flags_builder, g_variant_new("b", flags[i]));
-       not_acquired_flags = g_variant_builder_end(flags_builder);
-       mmresource_manager_complete_commit(interface, invocation, error, not_acquired_flags);
+       mmresource_manager_complete_commit(interface, invocation, error, g_variant_builder_end(flags_builder));
 
        g_free(flags);
        g_variant_builder_unref(flags_builder);
+
+out:
        g_variant_iter_free(release_array);
        g_variant_iter_free(acquire_array);
 
-       return TRUE;
+       return ret;
 }
 
 static void on_bus_acquired(GDBusConnection *connection, const gchar *name,