Bug 38406 - If disconnecting, dbus_g_proxy_begin_call returns a value that crashes dbus_g_proxy_end_call
Summary: If disconnecting, dbus_g_proxy_begin_call returns a value that crashes dbus_g...
Status: RESOLVED FIXED
Alias: None
Product: dbus
Classification: Unclassified
Component: GLib (show other bugs)
Version: unspecified
Hardware: Other All
: medium major
Assignee: Simon McVittie
QA Contact: John (J5) Palmieri
URL: http://cgit.freedesktop.org/~smcv/dbu...
Whiteboard: review+
Keywords: patch
Depends on:
Blocks:
 
Reported: 2011-06-17 06:39 UTC by Simon McVittie
Modified: 2011-08-15 03:40 UTC (History)
6 users (show)

See Also:
i915 platform:
i915 features:


Attachments
[PATCH 1/5] DBusGProxy: cope gracefully with call_id == 0 (2.01 KB, patch)
2011-06-17 06:44 UTC, Simon McVittie
Details | Splinter Review
[PATCH 2/5] dbus_g_proxy_call: simplify error handling now that call_id may be 0 (1.31 KB, patch)
2011-06-17 06:45 UTC, Simon McVittie
Details | Splinter Review
[PATCH 3/5] DBusGProxy: deal with errors in DBUS_G_VALUE_ARRAY_COLLECT_ALL (7.22 KB, patch)
2011-06-17 06:46 UTC, Simon McVittie
Details | Splinter Review
[PATCH 4/5] MyObject: register marshallers so individual tests don't have to (3.48 KB, patch)
2011-06-17 06:54 UTC, Simon McVittie
Details | Splinter Review
[PATCH 5/5] Add a regression test for fd.o #38406 (8.52 KB, patch)
2011-06-17 06:54 UTC, Simon McVittie
Details | Splinter Review

Description Simon McVittie 2011-06-17 06:39:47 UTC
dbus_g_proxy_end_call assumes that the passed-in call_id is not 0. However, dbus_g_proxy_begin_call can legitimately return 0, if the DBusConnection is disconnected but the Disconnect message has not yet been processed.

This situation is handled gracefully in dbus_g_proxy_call (which was Bug #12675), but not in dbus_g_proxy_call_with_timeout (which seems to have been copied from dbus_g_proxy_call after Kimmo Hämäläinen wrote the patch for Bug #12675, but before Colin merged it). In any case, users of the asynchronous API can't be expected to handle this situation, given that it's never been documented.

Relatedly, dbus_g_proxy_begin_call returns 0 on certain detectable programmer errors. One such error is failure to G_VALUE_COLLECT() one of the arguments - but on such errors, the DBUS_G_VALUE_ARRAY_COLLECT_ALL macro currently leaks and ignores the error. We should trap these errors and emit a critical warning.

(The patch for DBUS_G_VALUE_ARRAY_COLLECT_ALL is based on patches by Kimmo Hämäläinen and Christian Dywan, for Maemo.)
Comment 1 Simon McVittie 2011-06-17 06:44:31 UTC
Created attachment 48093 [details] [review]
[PATCH 1/5] DBusGProxy: cope gracefully with call_id == 0

s well as happening on a programming error or OOM (which both provoke
critical warnings), dbus_g_proxy_begin_call_internal() can legitimately
fail if we got disconnected from D-Bus (so can't send any more), but are
still working through our backlog of incoming messages (so we haven't
got round to the Disconnected message yet, so the DBusGProxy hasn't
emitted ::destroy).

fd.o #12675 fixed dbus_g_proxy_call(), but dbus_g_proxy_call_with_timeout()
and the asynchronous API still need similar treatment.
Comment 2 Simon McVittie 2011-06-17 06:45:11 UTC
Created attachment 48094 [details] [review]
[PATCH 2/5] dbus_g_proxy_call: simplify error handling now that  call_id may be 0

There's no need to special-case it any more - we can just use
dbus_g_proxy_end_call_internal and rely on it to cope.

This reverts the fix for Bug #12675, since the commit before this one
is more general.
Comment 3 Simon McVittie 2011-06-17 06:46:03 UTC
Created attachment 48095 [details] [review]
[PATCH 3/5] DBusGProxy: deal with errors in  DBUS_G_VALUE_ARRAY_COLLECT_ALL

G_VALUE_COLLECT can fail (admittedly, it's a programming error if it
does). Previously, we leaked the resulting g_malloc'd string; now we
emit a critical warning, free it, and abort the call.

Based on patches from Kimmo Hämäläinen and Christian Dywan in Maemo's
dbus-glib.
 
Bug-NB: NB#86280
Bug-NB: NB#180486 (CID-34419 to CID-34424 inclusive)
Comment 4 Simon McVittie 2011-06-17 06:54:17 UTC
Created attachment 48096 [details] [review]
[PATCH 4/5] MyObject: register marshallers so  individual tests don't have to

These marshallers are actually dual-use: they're used to call certain
methods on MyObject, and also to bind to its signals.
Comment 5 Simon McVittie 2011-06-17 06:54:38 UTC
Created attachment 48097 [details] [review]
[PATCH 5/5] Add a regression test for fd.o #38406
Comment 6 Cosimo Alfarano 2011-08-12 08:36:57 UTC
Review of attachment 48093 [details] [review]:

no hat review+
Comment 7 Cosimo Alfarano 2011-08-12 08:37:04 UTC
Review of attachment 48094 [details] [review]:

no hat review+
Comment 8 Cosimo Alfarano 2011-08-12 08:37:16 UTC
Review of attachment 48095 [details] [review]:

no hat review+
Comment 9 Cosimo Alfarano 2011-08-12 08:37:26 UTC
Review of attachment 48096 [details] [review]:

no hat review+
Comment 10 Cosimo Alfarano 2011-08-12 08:37:36 UTC
Review of attachment 48097 [details] [review]:

no hat review+
Comment 11 Simon McVittie 2011-08-15 01:33:59 UTC
This has been sitting here for weeks with no veto, so I'm going to consider Cosimo's review sufficient and merge this shortly.
Comment 12 Simon McVittie 2011-08-15 03:40:48 UTC
Fixed in git for 0.96


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.