From fbcabeb7f72b710a790ca8617f7406a1ba7cf5be Mon Sep 17 00:00:00 2001 From: Thomas Haller Date: Mon, 18 Nov 2013 22:20:05 +0100 Subject: [PATCH] libnm-glib: fix crash by taking additional ref in nm-remote-connection/result_cb MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit result_cb invokes a function pointer provided by the user. Nothing prevents the user from destroying the NMRemoteConnection in the callback, which leads to a crash. Take an additional ref of NMRemoteConnection to keep it alive. This probably caused a crash for nm-applet: https://bugzilla.redhat.com/show_bug.cgi?id=1030403 Signed-off-by: Thomas Haller Signed-off-by: Jiří Klimeš --- libnm-glib/nm-remote-connection.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libnm-glib/nm-remote-connection.c b/libnm-glib/nm-remote-connection.c index a03a44b..73a2cc8 100644 --- a/libnm-glib/nm-remote-connection.c +++ b/libnm-glib/nm-remote-connection.c @@ -137,12 +137,14 @@ result_cb (DBusGProxy *proxy, DBusGProxyCall *proxy_call, gpointer user_data) RemoteCall *call = user_data; NMRemoteConnectionResultFunc func = (NMRemoteConnectionResultFunc) call->callback; GError *error = NULL; + NMRemoteConnection *self = g_object_ref (call->self); dbus_g_proxy_end_call (proxy, proxy_call, &error, G_TYPE_INVALID); if (func) (*func) (call->self, error, call->user_data); g_clear_error (&error); remote_call_complete (call->self, call); + g_object_unref (self); } /** -- 1.7.11.7