diff options
| author | Thomas Haller <thaller@redhat.com> | 2013-11-18 22:20:05 +0100 |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2013-11-18 23:01:35 +0100 |
| commit | fbcabeb7f72b710a790ca8617f7406a1ba7cf5be (patch) | |
| tree | f4f239a776be3b076b3711100761c19e991d05ca | |
| parent | f93c15416152c1d071102cce716d82a1d3616c44 (diff) | |
| download | NetworkManager-fbcabeb7f72b710a790ca8617f7406a1ba7cf5be.tar.gz | |
libnm-glib: fix crash by taking additional ref in nm-remote-connection/result_cb
result_cb invokes a function pointer provided by the user. Nothing prevents
the user from destroying the NMRemoteConnection in the callback, which leads
to a crash. Take an additional ref of NMRemoteConnection to keep it
alive.
This probably caused a crash for nm-applet:
https://bugzilla.redhat.com/show_bug.cgi?id=1030403
Signed-off-by: Thomas Haller <thaller@redhat.com>
| -rw-r--r-- | libnm-glib/nm-remote-connection.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libnm-glib/nm-remote-connection.c b/libnm-glib/nm-remote-connection.c index a03a44bf42..73a2cc83ef 100644 --- a/libnm-glib/nm-remote-connection.c +++ b/libnm-glib/nm-remote-connection.c @@ -137,12 +137,14 @@ result_cb (DBusGProxy *proxy, DBusGProxyCall *proxy_call, gpointer user_data) RemoteCall *call = user_data; NMRemoteConnectionResultFunc func = (NMRemoteConnectionResultFunc) call->callback; GError *error = NULL; + NMRemoteConnection *self = g_object_ref (call->self); dbus_g_proxy_end_call (proxy, proxy_call, &error, G_TYPE_INVALID); if (func) (*func) (call->self, error, call->user_data); g_clear_error (&error); remote_call_complete (call->self, call); + g_object_unref (self); } /** |