diff --git a/0001-Server-Ensure-that-g_context.watchers-has-a-valid-va.patch b/0001-Server-Ensure-that-g_context.watchers-has-a-valid-va.patch new file mode 100644 index 0000000..5fe61ca --- /dev/null +++ b/0001-Server-Ensure-that-g_context.watchers-has-a-valid-va.patch @@ -0,0 +1,35 @@ +From 2f9fdf97082b63fcd0809905d29d0f8a49bb5c43 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 20 Jan 2015 11:20:07 +0100 +Subject: [PATCH] [Server] Ensure that g_context.watchers has a valid value + +Since g_context.watchers is an unsigned integer, we should be careful +not to decrement it below zero. This can happen if the service is +spawned as a result of the following command: +$ gdbus call \ + --session \ + --dest com.intel.dleyna-renderer \ + --object-path /com/intel/dLeynaRenderer \ + --method com.intel.dLeynaRenderer.Manager.Release +--- + libdleyna/renderer/server.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/libdleyna/renderer/server.c b/libdleyna/renderer/server.c +index b241a4f..b0af8d1 100644 +--- a/libdleyna/renderer/server.c ++++ b/libdleyna/renderer/server.c +@@ -688,7 +688,9 @@ static void prv_remove_client(const gchar *name) + + dlr_upnp_lost_client(g_context.upnp, name); + +- g_context.watchers--; ++ if (g_context.watchers > 0) ++ g_context.watchers--; ++ + if (g_context.watchers == 0) + if (!dleyna_settings_is_never_quit(g_context.settings)) + dleyna_task_processor_set_quitting(g_context.processor); +-- +2.1.0 + diff --git a/0001-UPnP-Disconnect-signal-handlers-during-destruction.patch b/0001-UPnP-Disconnect-signal-handlers-during-destruction.patch new file mode 100644 index 0000000..fe12077 --- /dev/null +++ b/0001-UPnP-Disconnect-signal-handlers-during-destruction.patch @@ -0,0 +1,77 @@ +From ae4a03a2c6928d0d3c8fbcdba4831ce1d212f50b Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 20 Jan 2015 13:59:33 +0100 +Subject: [PATCH] [UPnP] Disconnect signal handlers during destruction + +A GUPnPContextManager can outlive a dlr_upnp_t because it might be +using asynchronous operations during its construction (eg., +GUPnPNetworkManager) which retain references to it. This can be +demonstrated if the service is spawned as a result of the following +command: +$ gdbus call \ + --session \ + --dest com.intel.dleyna-renderer \ + --object-path /com/intel/dLeynaRenderer \ + --method com.intel.dLeynaRenderer.Manager.Release + +This leads to the signal handlers being invoked with an invalid +dlr_upnp_t and the outcome is a crash. + +To avoid this, we should disconnect the callbacks listening to the +context manager and the control points belonging to it. +--- + libdleyna/renderer/upnp.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/libdleyna/renderer/upnp.c b/libdleyna/renderer/upnp.c +index fefc340..cce4f4f 100644 +--- a/libdleyna/renderer/upnp.c ++++ b/libdleyna/renderer/upnp.c +@@ -45,6 +45,7 @@ struct dlr_upnp_t_ { + void *user_data; + GHashTable *server_udn_map; + GHashTable *server_uc_map; ++ GList *cps; + guint counter; + dlr_host_service_t *host_service; + }; +@@ -357,6 +358,7 @@ static void prv_on_context_available(GUPnPContextManager *context_manager, + + gssdp_resource_browser_set_active(GSSDP_RESOURCE_BROWSER(cp), TRUE); + gupnp_context_manager_manage_control_point(upnp->context_manager, cp); ++ upnp->cps = g_list_prepend (upnp->cps, g_object_ref (cp)); + g_object_unref(cp); + } + +@@ -393,10 +395,28 @@ dlr_upnp_t *dlr_upnp_new(dleyna_connector_id_t connection, + void dlr_upnp_delete(dlr_upnp_t *upnp) + { + if (upnp) { ++ GList *l; ++ ++ for (l = upnp->cps; l != NULL; l = l->next) { ++ GUPnPControlPoint *cp = GUPNP_CONTROL_POINT (l->data); ++ ++ g_signal_handlers_disconnect_by_func (cp, ++ prv_server_available_cb, ++ upnp); ++ g_signal_handlers_disconnect_by_func (cp, ++ prv_server_unavailable_cb, ++ upnp); ++ } ++ ++ g_signal_handlers_disconnect_by_func (upnp->context_manager, ++ prv_on_context_available, ++ upnp); ++ + dlr_host_service_delete(upnp->host_service); + g_object_unref(upnp->context_manager); + g_hash_table_unref(upnp->server_udn_map); + g_hash_table_unref(upnp->server_uc_map); ++ g_list_free_full (upnp->cps, g_object_unref); + + g_free(upnp); + } +-- +2.1.0 + diff --git a/dleyna-renderer.spec b/dleyna-renderer.spec index 00f0cfb..9e45e3e 100644 --- a/dleyna-renderer.spec +++ b/dleyna-renderer.spec @@ -2,12 +2,14 @@ Name: dleyna-renderer Version: 0.4.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Service for interacting with Digital Media Renderers License: LGPLv2 URL: https://01.org/dleyna/ Source0: https://01.org/dleyna/sites/default/files/downloads/%{name}-%{version}.tar.gz +Patch0: 0001-Server-Ensure-that-g_context.watchers-has-a-valid-va.patch +Patch1: 0001-UPnP-Disconnect-signal-handlers-during-destruction.patch BuildRequires: dleyna-core-devel BuildRequires: glib2-devel >= 2.28 @@ -27,6 +29,8 @@ Renderers (DMRs). %prep %setup -q +%patch0 -p1 +%patch1 -p1 %build @@ -67,6 +71,10 @@ rm -rf $RPM_BUILD_ROOT/%{_libdir}/pkgconfig %changelog +* Tue Jan 20 2015 Debarshi Ray - 0.4.0-4 +- Fix crash when spawned by a call to com.intel.dLeynaRenderer.Manager.Release + (RH #1154788) + * Sat Aug 16 2014 Fedora Release Engineering - 0.4.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild