diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2013-09-24 17:34:02 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2013-09-29 17:01:07 +0300 |
| commit | c9f3b81d07cd25e6fbab62278ee21895fe077b68 (patch) | |
| tree | cb97eb41e2c7dc6d04c1c444546aade2844c8765 /gobex | |
| parent | d393673986f27c5c335255352e9fc058c40fd96f (diff) | |
| download | bluez-c9f3b81d07cd25e6fbab62278ee21895fe077b68.tar.gz | |
gobex: Fix crash on g_obex_pending_req_abort
It is not safe to call g_obex_pending_req_abort directly as pending_req
can be NULL:
Invalid read of size 4
at 0x41231E: g_obex_pending_req_abort (gobex.c:693)
by 0x416A8A: g_obex_cancel_transfer (gobex-transfer.c:647)
by 0x42DEF2: obc_transfer_cancel (transfer.c:180)
by 0x43D833: process_message.isra.5 (object.c:259)
by 0x3B0701CE85: ??? (in /usr/lib64/libdbus-1.so.3.7.4)
by 0x3B0700FA30: dbus_connection_dispatch (in /usr/lib64/libdbus-1.so.3.7.4)
by 0x43A5B7: message_dispatch (mainloop.c:76)
by 0x3B03C48962: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
by 0x3B03C47E05: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3600.3)
by 0x3B03C48157: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
by 0x3B03C48559: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3600.3)
by 0x40D53C: main (main.c:319)
Address 0x30 is not stack'd, malloc'd or (recently) free'd
Diffstat (limited to 'gobex')
| -rw-r--r-- | gobex/gobex-transfer.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/gobex/gobex-transfer.c b/gobex/gobex-transfer.c index 4203fec0f..b815d6070 100644 --- a/gobex/gobex-transfer.c +++ b/gobex/gobex-transfer.c @@ -644,7 +644,10 @@ gboolean g_obex_cancel_transfer(guint id, GObexFunc complete_func, transfer->complete_func = complete_func; transfer->user_data = user_data; - ret = g_obex_pending_req_abort(transfer->obex, NULL); + if (transfer->req_id == 0) + goto done; + + ret = g_obex_cancel_req(transfer->obex, transfer->req_id, FALSE); if (ret) return TRUE; |