[evince/gnome-3-28] shell: Fix crash in ev_media_player_keys_grab_keys

[Marek Kašík <mkasik src gnome org>]

commit 92ca99e3920e7c9acf8aff4971c427ac4fe14164
Author: Marek Kasik <mkasik redhat com>
Date:   Fri May 11 11:42:08 2018 +0200

    shell: Fix crash in ev_media_player_keys_grab_keys
    
    Asynchronous getting of a DBus proxy can finish after EvMediaPlayerKeys
    is finalized but this is not secured by a cancellable and hence it crashes
    in callback of the getting of the proxy.
    This commit adds the cancellable.
    
    When g_dbus_proxy_new_for_bus() is cancelled because EvMediaPlayerKeys
    is finalized, don't use the user_data (which will be invalid) before
    checking the return of the call.
    
    The user_data will only be valid if the error returned by the _finish()
    call is not G_IO_ERROR_CANCELLED (Bastien Nocera).
    
    https://retrace.fedoraproject.org/faf/reports/1649005/
    https://bugzilla.redhat.com/show_bug.cgi?id=1359507
    
    https://bugzilla.gnome.org/show_bug.cgi?id=795978

 shell/ev-media-player-keys.c |   15 +++++++++++----
 1 files changed, 11 insertions(+), 4 deletions(-)
---
diff --git a/shell/ev-media-player-keys.c b/shell/ev-media-player-keys.c
index a0075ed..d7b2dde 100644
--- a/shell/ev-media-player-keys.c
+++ b/shell/ev-media-player-keys.c
@@ -41,8 +41,9 @@ struct _EvMediaPlayerKeys
 {
        GObject        parent;
 
-        GDBusProxy *proxy;
-       gboolean    has_name_owner;
+        GDBusProxy   *proxy;
+       gboolean      has_name_owner;
+       GCancellable *cancellable;
 };
 
 struct _EvMediaPlayerKeysClass
@@ -163,7 +164,7 @@ mediakeys_service_appeared_cb (GObject      *source_object,
                               GAsyncResult *res,
                               gpointer      user_data)
 {
-        EvMediaPlayerKeys *keys = EV_MEDIA_PLAYER_KEYS (user_data);
+       EvMediaPlayerKeys *keys;
        GDBusProxy *proxy;
 
        proxy = g_dbus_proxy_new_for_bus_finish (res, NULL);
@@ -172,6 +173,7 @@ mediakeys_service_appeared_cb (GObject      *source_object,
                return;
        }
 
+       keys = EV_MEDIA_PLAYER_KEYS (user_data);
        g_signal_connect (proxy, "g-signal",
                          G_CALLBACK (media_player_key_pressed_cb),
                          keys);
@@ -187,13 +189,15 @@ mediakeys_service_appeared_cb (GObject      *source_object,
 static void
 ev_media_player_keys_init (EvMediaPlayerKeys *keys)
 {
+       keys->cancellable = g_cancellable_new ();
+
        g_dbus_proxy_new_for_bus (G_BUS_TYPE_SESSION,
                                  G_DBUS_PROXY_FLAGS_DO_NOT_LOAD_PROPERTIES,
                                  NULL,
                                  SD_NAME,
                                  SD_OBJECT_PATH,
                                  SD_INTERFACE,
-                                 NULL,
+                                 keys->cancellable,
                                  mediakeys_service_appeared_cb,
                                  keys);
 }
@@ -212,6 +216,9 @@ ev_media_player_keys_finalize (GObject *object)
 {
        EvMediaPlayerKeys *keys = EV_MEDIA_PLAYER_KEYS (object);
 
+       g_cancellable_cancel (keys->cancellable);
+       g_object_unref (keys->cancellable);
+
         if (keys->proxy != NULL) {
                ev_media_player_keys_release_keys (keys);
                 g_object_unref (keys->proxy);