Skip to content
  • Milan Crha's avatar
    Fix use-after-free when calling g_dbus_connection_flush_sync() · 822f8bae
    Milan Crha authored and Philip Withnall's avatar Philip Withnall committed
    When the _g_dbus_worker_flush_sync() schedules the 'data' and releases
    the worker->write_lock, it is possible for the GDBus worker thread thread
    to finish the D-Bus call and acquire the worker->write_lock before
    the _g_dbus_worker_flush_sync() re-acquires it in the if (data != NULL) body.
    When that happens, the ostream_flush_cb() increases the worker->write_num_messages_flushed
    and then releases the worker->write_lock. The write lock is reacquired by
    the _g_dbus_worker_flush_sync(), which sees that the while condition is satisfied,
    thus it doesn't enter the loop body and immediately clears the data members and
    frees the data structure itself. The ostream_flush_cb() is still ongoing, possibly
    inside flush_data_list_complete(), where it accesses the FlushData, which can be
    in any stage of being freed.
    
    Instead, add an explicit boolean flag indicating when the flush is truly finished.
    
    Closes #1896
    822f8bae