[gnome-bluetooth] tests: Implement UpClient use-after-free test

[Bastien Nocera <hadess src gnome org>]

commit c31d8f351146f0a81a0769ac8644ba48cfefd0ae
Author: Bastien Nocera <hadess hadess net>
Date:   Wed Feb 16 11:19:35 2022 +0100

    tests: Implement UpClient use-after-free test

 tests/test_battery.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
---
diff --git a/tests/test_battery.c b/tests/test_battery.c
index 938af139..35029ef4 100644
--- a/tests/test_battery.c
+++ b/tests/test_battery.c
@@ -8,6 +8,28 @@
 #include <bluetooth-device.h>
 #include <libupower-glib/upower.h>
 
+static void
+remove_upower_device (GDBusConnection *bus,
+                     const char      *object_path)
+{
+       g_autoptr(GVariant) ret = NULL;
+       g_autoptr(GError) error = NULL;
+
+       ret = g_dbus_connection_call_sync (bus,
+                                          "org.freedesktop.UPower",
+                                          "/org/freedesktop/UPower",
+                                          "org.freedesktop.DBus.Mock",
+                                          "RemoveDevice",
+                                          g_variant_new ("(o)", object_path),
+                                          NULL,
+                                          G_DBUS_CALL_FLAGS_NONE,
+                                          -1,
+                                          NULL,
+                                          &error);
+       g_assert_no_error (error);
+       g_assert_nonnull (ret);
+}
+
 int main (int argc, char **argv)
 {
        BluetoothClient *client;
@@ -54,5 +76,53 @@ int main (int argc, char **argv)
        g_clear_object (&client);
        g_clear_object (&list_store);
 
+       /* Start use-after-free test */
+       BluetoothClient *client2;
+       GListStore *list_store2;
+
+       client2 = bluetooth_client_new ();
+       list_store2 = bluetooth_client_get_devices (client2);
+
+       while (g_list_model_get_n_items (G_LIST_MODEL (list_store2)) != 2)
+               g_main_context_iteration (NULL, TRUE);
+       g_assert_cmpuint (g_list_model_get_n_items (G_LIST_MODEL (list_store2)), ==, 2);
+
+       BluetoothDevice *device2;
+       device2 = g_list_model_get_item (G_LIST_MODEL (list_store2), 0);
+       g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+       while (battery_type != BLUETOOTH_BATTERY_TYPE_PERCENTAGE) {
+               g_main_context_iteration (NULL, TRUE);
+               g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+       }
+
+       GDBusConnection *bus;
+       bus = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, NULL);
+       remove_upower_device (bus, "/org/freedesktop/UPower/devices/mouse_dev_11_22_33_44_55_66");
+       g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+       while (battery_type != BLUETOOTH_BATTERY_TYPE_NONE) {
+               g_main_context_iteration (NULL, TRUE);
+               g_object_get (G_OBJECT (device2), "battery-type", &battery_type, NULL);
+       }
+       g_object_unref (G_OBJECT (device2));
+
+       g_dbus_connection_call_sync (bus,
+                                    "org.bluez",
+                                    "/org/bluez/hci0",
+                                    "org.bluez.Adapter1",
+                                    "RemoveDevice",
+                                    g_variant_new ("(o)", "/org/bluez/hci0/dev_11_22_33_44_55_67"),
+                                    NULL,
+                                    G_DBUS_CALL_FLAGS_NONE,
+                                    -1,
+                                    NULL,
+                                    NULL);
+       remove_upower_device (bus, "/org/freedesktop/UPower/devices/mouse_dev_11_22_33_44_55_67");
+       while (g_list_model_get_n_items (G_LIST_MODEL (list_store2)) != 1)
+               g_main_context_iteration (NULL, TRUE);
+       g_assert_cmpuint (g_list_model_get_n_items (G_LIST_MODEL (list_store2)), ==, 1);
+
+       g_object_unref (G_OBJECT (list_store2));
+       g_object_unref (G_OBJECT (client2));
+
        return 0;
 }