From d2b9f082e8684be41e9cd0d3de6edf488803e236 Mon Sep 17 00:00:00 2001 From: Aleksander Morgado Date: Mon, 17 Oct 2022 21:27:01 +0000 Subject: libqmi-glib: ensure client is valid during message processing The Client object may be untracked while processing a message (e.g. if forwarding the response back to the remote client fails), and so the tracked reference may end up disposed. If that happens, any attempt to use the client object would end up reading already freed memory, and it would segfault, (e.g. in the `while (client->buffer->len > 0)` check just after having run `process_message()` in `parse_request()`. Avoid this by ensuring a valid Client reference is kept around during all this processing. Thread 0(id: 3232) CRASHED [ SIGSEGV /0x00000000@0x0000000000000004 ] 0x00000000e94d8cdc (libqmi-glib.so.5 - qmi-proxy.c: 942) connection_readable_cb 0x00000000e90aa593 (libgio-2.0.so.0 - gsocket.c: 4008) socket_source_dispatch 0x00000000e934de5b (libglib-2.0.so.0 - gmain.c: 3325) g_main_context_dispatch 0x00000000e934e083 (libglib-2.0.so.0 - gmain.c: 4119) g_main_context_iterate 0x00000000e934e2b3 (libglib-2.0.so.0 - gmain.c: 4317) g_main_loop_run 0x00000000071ebe93 (qmi-proxy - qmi-proxy.c: 230) main 0x00000000e91d1a9b (libc.so.6 - libc-start.c: 314) __libc_start_main 0x00000000071ebcbb (qmi-proxy) _start 0x00000000071ec10b (qmi-proxy - elf-init.c: 90) __libc_csu_init 0x00000000ff9eff8a Fixes https://gitlab.freedesktop.org/mobile-broadband/libqmi/-/issues/72 --- src/libqmi-glib/qmi-proxy.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) (limited to 'src') diff --git a/src/libqmi-glib/qmi-proxy.c b/src/libqmi-glib/qmi-proxy.c index 094148ed..eeff4bf0 100644 --- a/src/libqmi-glib/qmi-proxy.c +++ b/src/libqmi-glib/qmi-proxy.c @@ -168,6 +168,8 @@ client_unref (Client *client) } } +G_DEFINE_AUTOPTR_CLEANUP_FUNC (Client, client_unref) + static Client * client_ref (Client *client) { @@ -941,15 +943,17 @@ parse_request (QmiProxy *self, } static gboolean -connection_readable_cb (GSocket *socket, - GIOCondition condition, - Client *client) +connection_readable_cb (GSocket *socket, + GIOCondition condition, + Client *_client) { - QmiProxy *self; - guint8 buffer[BUFFER_SIZE]; - GError *error = NULL; - gssize r; + g_autoptr(Client) client = NULL; + QmiProxy *self; + guint8 buffer[BUFFER_SIZE]; + GError *error = NULL; + gssize r; + client = client_ref (_client); self = client->proxy; if (condition & G_IO_IN || condition & G_IO_PRI) { -- cgit v1.2.1