From: Weng Xuetian <wengxt@gmail.com>
Date: Wed, 29 Jun 2016 20:22:12 +0000 (-0700)
Subject: sd-bus: Fix a read after free error in bus-match. (#3624) (#3625)
X-Git-Tag: v231.3~82
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=commitdiff_plain;h=5fe94801a659675f35b52f974942fb7ee9b8f3fc;p=elogind.git

sd-bus: Fix a read after free error in bus-match. (#3624) (#3625)

The loop on bus_match_run should break and return immediately if
bus->match_callbacks_modified is true. Otherwise the loop may access
free'd data.
---

diff --git a/src/libelogind/sd-bus/bus-match.c b/src/libelogind/sd-bus/bus-match.c
index dda0b5c50..3e6930a0d 100644
--- a/src/libelogind/sd-bus/bus-match.c
+++ b/src/libelogind/sd-bus/bus-match.c
@@ -429,6 +429,9 @@ int bus_match_run(
                         r = bus_match_run(bus, c, m);
                         if (r != 0)
                                 return r;
+
+                        if (bus && bus->match_callbacks_modified)
+                                return 0;
                 }
         }