[gnome-boxes] search: Fix use-after-free in dbus methods



commit 30c63058f6fdd12a0db795b896df553ceeb7891d
Author: Alexander Larsson <alexl redhat com>
Date:   Tue Oct 23 20:08:40 2012 +0200

    search: Fix use-after-free in dbus methods
    
    The async dbus method implementation gets array arguments which
    are used after yield, but the generated dbus code that calls
    these frees the arguments directly after the call, so we access
    them after they are freed.
    
    The correct way to solve this is to make the parameters "owned"
    which means the caller needs to copy the arguments. However, this
    doesn't seem to work for the case of the dbus generated call, so
    we wrap the dbus method implementations in a normal method which
    causes owned arguments to work.

 src/gnome-boxes-search-provider.vala |   10 ++++++++--
 1 files changed, 8 insertions(+), 2 deletions(-)
---
diff --git a/src/gnome-boxes-search-provider.vala b/src/gnome-boxes-search-provider.vala
index 7aa4fc8..1b8da11 100644
--- a/src/gnome-boxes-search-provider.vala
+++ b/src/gnome-boxes-search-provider.vala
@@ -75,7 +75,7 @@ public class Boxes.SearchProvider: Object {
         return 0;
     }
 
-    private async string[] search (string[] terms) {
+    private async string[] search (owned string[] terms) {
         app.hold ();
         string[] normalized_terms = canonicalize_for_search (string.joinv(" ", terms)).split(" ");
         var matches = new GenericArray<DisplayProperties> ();
@@ -107,7 +107,7 @@ public class Boxes.SearchProvider: Object {
         return yield search (new_terms);
     }
 
-    public async HashTable<string, Variant>[] GetResultMetas (string[] ids) {
+    public async HashTable<string, Variant>[] get_metas (owned string[] ids) {
         var metas = new HashTable<string, Variant>[ids.length];
         app.hold ();
 
@@ -143,6 +143,12 @@ public class Boxes.SearchProvider: Object {
         return metas[0:n];
     }
 
+    /* We have to put this in a separate method because vala does not seem to honor "owned"
+       in the dbus method handler. I.e. it doesn't copy the ids array. */
+    public async HashTable<string, Variant>[] GetResultMetas (string[] ids) {
+        return yield get_metas (ids);
+    }
+
     public void ActivateResult (string search_id) {
         app.hold ();
 



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]