chiark / gitweb /
sd-bus: Fix a read after free error in bus-match. (#3624) (#3625)
authorWeng Xuetian <wengxt@gmail.com>
Wed, 29 Jun 2016 20:22:12 +0000 (13:22 -0700)
committerSven Eden <yamakuzure@gmx.net>
Fri, 16 Jun 2017 08:13:01 +0000 (10:13 +0200)
The loop on bus_match_run should break and return immediately if
bus->match_callbacks_modified is true. Otherwise the loop may access
free'd data.

src/libelogind/sd-bus/bus-match.c

index dda0b5c50a6ff2647b0e5763d397593348bebd5b..3e6930a0d3de2c4ad989369336002e09e0b2bcfc 100644 (file)
@@ -429,6 +429,9 @@ int bus_match_run(
                         r = bus_match_run(bus, c, m);
                         if (r != 0)
                                 return r;
+
+                        if (bus && bus->match_callbacks_modified)
+                                return 0;
                 }
         }