Attachment 632271 Details for Bug 867149 – Fix

[patch] Fix

0001-search-Fix-use-after-free-in-dbus-methods.patch (text/plain), 2.32 KB, created by Alexander Larsson on 2012-10-23 18:16:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexander Larsson

Created: 2012-10-23 18:16:22 UTC

Size: 2.32 KB

patch

obsolete

>From 7a8256b3919783b742c5ff2bdcf86441eedee202 Mon Sep 17 00:00:00 2001
>From: Alexander Larsson <alexl@redhat.com>
>Date: Tue, 23 Oct 2012 20:08:40 +0200
>Subject: [PATCH] search: Fix use-after-free in dbus methods
>
>The async dbus method implementation gets array arguments which
>are used after yield, but the generated dbus code that calls
>these frees the arguments directly after the call, so we access
>them after they are freed.
>
>The correct way to solve this is to make the parameters "owned"
>which means the caller needs to copy the arguments. However, this
>doesn't seem to work for the case of the dbus generated call, so
>we wrap the dbus method implementations in a normal method which
>causes owned arguments to work.
>---
> src/gnome-boxes-search-provider.vala | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
>diff --git a/src/gnome-boxes-search-provider.vala b/src/gnome-boxes-search-provider.vala
>index 7aa4fc8..0c8346c 100644
>--- a/src/gnome-boxes-search-provider.vala
>+++ b/src/gnome-boxes-search-provider.vala
>@@ -75,7 +75,7 @@ private static int compare_boxes (DisplayProperties a, DisplayProperties b) {
>         return 0;
>     }
> 
>-    private async string[] search (string[] terms) {
>+    private async string[] search (owned string[] terms) {
>         app.hold ();
>         string[] normalized_terms = canonicalize_for_search (string.joinv(" ", terms)).split(" ");
>         var matches = new GenericArray<DisplayProperties> ();
>@@ -107,7 +107,7 @@ private static int compare_boxes (DisplayProperties a, DisplayProperties b) {
>         return yield search (new_terms);
>     }
> 
>-    public async HashTable<string, Variant>[] GetResultMetas (string[] ids) {
>+    public async HashTable<string, Variant>[] get_metas (owned string[] ids) {
>         var metas = new HashTable<string, Variant>[ids.length];
>         app.hold ();
> 
>@@ -143,6 +143,12 @@ private static int compare_boxes (DisplayProperties a, DisplayProperties b) {
>         return metas[0:n];
>     }
> 
>+    /* We have to put this in a separate file because vala does not seem to honor "owned"
>+       in the dbus method handler. I.e. it doesn't copy the ids array. */
>+    public async HashTable<string, Variant>[] GetResultMetas (string[] ids) {
>+        return yield get_metas (ids);
>+    }
>+
>     public void ActivateResult (string search_id) {
>         app.hold ();
> 
>-- 
>1.7.12.1
>

Actions: View | Diff

Attachments on bug 867149: 628419 | 628420 | 628421 | 628422 | 628423 | 628424 | 628425 | 628426 | 628427 | 628428 | 628429 | 632271