Attachment 42269 Details for Bug 33277 – [alternative patch 2] test_server_setup: allocate two server-data blobs, for watches and timeouts

[patch] [alternative patch 2] test_server_setup: allocate two server-data blobs, for watches and timeouts

0001-test-utils-refcount-ServerData.patch (text/plain), 2.81 KB, created by Simon McVittie on 2011-01-21 06:25:23 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2011-01-21 06:25:23 UTC

Size: 2.81 KB

patch

obsolete

>From 935243e2ab9b2025d94574b12ffd7b3dbe812412 Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Fri, 21 Jan 2011 14:16:50 +0000
>Subject: [PATCH] test-utils: refcount ServerData
>
>Without this change, we deserve to segfault: when the first set of
>callbacks (either watches or timeouts) is cleaned up, we unref the server
>and loop, and free sd; when the second set of callbacks is cleaned up, we
>use-after-free sd, the server and the loop, then double-free sd.
>
>However, due to fd.o #33277 we don't even get that far, because we've
>already died with an assertion failure.
>
>Bug: https://bugs.freedesktop.org/show_bug.cgi?id=33277
>---
> test/test-utils.c |   29 +++++++++++++++++++++++------
> 1 files changed, 23 insertions(+), 6 deletions(-)
>
>diff --git a/test/test-utils.c b/test/test-utils.c
>index 67e207c..c56b6ac 100644
>--- a/test/test-utils.c
>+++ b/test/test-utils.c
>@@ -191,21 +191,32 @@ test_connection_shutdown (DBusLoop       *loop,
> 
> typedef struct
> {
>+  int refcount;
>   DBusLoop *loop;
>   DBusServer *server;
> } ServerData;
> 
> static void
>-serverdata_free (void *data)
>+serverdata_unref (void *data)
> {
>   ServerData *sd = data;
> 
>+  if (--sd->refcount > 0)
>+    return;
>+
>   dbus_server_unref (sd->server);
>   _dbus_loop_unref (sd->loop);
>   
>   dbus_free (sd);
> }
> 
>+static ServerData *
>+serverdata_ref (ServerData *sd)
>+{
>+  sd->refcount++;
>+  return sd;
>+}
>+
> static ServerData*
> serverdata_new (DBusLoop       *loop,
>                 DBusServer     *server)
>@@ -216,6 +227,7 @@ serverdata_new (DBusLoop       *loop,
>   if (sd == NULL)
>     return NULL;
> 
>+  sd->refcount = 1;
>   sd->loop = loop;
>   sd->server = server;
> 
>@@ -301,9 +313,10 @@ test_server_setup (DBusLoop      *loop,
>                                         add_server_watch,
>                                         remove_server_watch,
>                                         NULL,
>-                                        sd,
>-                                        serverdata_free))
>+                                        serverdata_ref (sd),
>+                                        serverdata_unref))
>     {
>+      serverdata_unref (sd);
>       goto nomem;
>     }
> 
>@@ -311,15 +324,19 @@ test_server_setup (DBusLoop      *loop,
>                                           add_server_timeout,
>                                           remove_server_timeout,
>                                           NULL,
>-                                          sd, serverdata_free))
>+                                          serverdata_ref (sd),
>+                                          serverdata_unref))
>     {
>+      serverdata_unref (sd);
>       goto nomem;
>-    }   
>+    }
>+
>+  serverdata_unref (sd);
>   return TRUE;
> 
>  nomem:
>   if (sd)
>-    serverdata_free (sd);
>+    serverdata_unref (sd);
>   
>   test_server_shutdown (loop, server);
>   
>-- 
>1.7.2.3
>

Actions: View | Splinter Review

Attachments on bug 33277: 42204 | 42205 | 42206 | 42225 | 42269

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.