mirror of
https://github.com/vanhoefm/fragattacks.git
synced 2025-01-18 10:54:03 -05:00
dbus: Fix flush_object_timeout_handler context to be consistent
The path pointer used as the timeout_ctx was not constant; the path string itself may have been the same, but the pointer certainly was not since it was sometimes from stack and sometimes from the dynamically allocated buffer in obj_desc. This caused some of the eloop timeout cancellations not to find the timeout. Fix this by using the obj_desc as the timeout context data.
This commit is contained in:
parent
0de4da91c1
commit
e30020c7ab
@ -593,8 +593,16 @@ int wpa_dbus_unregister_object_per_iface(
|
|||||||
struct wpas_dbus_priv *ctrl_iface, const char *path)
|
struct wpas_dbus_priv *ctrl_iface, const char *path)
|
||||||
{
|
{
|
||||||
DBusConnection *con = ctrl_iface->con;
|
DBusConnection *con = ctrl_iface->con;
|
||||||
|
struct wpa_dbus_object_desc *obj_desc = NULL;
|
||||||
|
|
||||||
eloop_cancel_timeout(flush_object_timeout_handler, con, (void *) path);
|
dbus_connection_get_object_path_data(con, path, (void **) &obj_desc);
|
||||||
|
if (!obj_desc) {
|
||||||
|
wpa_printf(MSG_ERROR, "dbus: %s: Could not obtain object's "
|
||||||
|
"private data: %s", __func__, path);
|
||||||
|
} else {
|
||||||
|
eloop_cancel_timeout(flush_object_timeout_handler, con,
|
||||||
|
obj_desc);
|
||||||
|
}
|
||||||
|
|
||||||
if (!dbus_connection_unregister_object_path(con, path))
|
if (!dbus_connection_unregister_object_path(con, path))
|
||||||
return -1;
|
return -1;
|
||||||
@ -693,11 +701,11 @@ err:
|
|||||||
static void flush_object_timeout_handler(void *eloop_ctx, void *timeout_ctx)
|
static void flush_object_timeout_handler(void *eloop_ctx, void *timeout_ctx)
|
||||||
{
|
{
|
||||||
DBusConnection *con = eloop_ctx;
|
DBusConnection *con = eloop_ctx;
|
||||||
const char *path = timeout_ctx;
|
struct wpa_dbus_object_desc *obj_desc = timeout_ctx;
|
||||||
|
|
||||||
wpa_printf(MSG_DEBUG, "dbus: %s: Timeout - sending changed properties "
|
wpa_printf(MSG_DEBUG, "dbus: %s: Timeout - sending changed properties "
|
||||||
"of object %s", __func__, path);
|
"of object %s", __func__, obj_desc->path);
|
||||||
wpa_dbus_flush_object_changed_properties(con, path);
|
wpa_dbus_flush_object_changed_properties(con, obj_desc->path);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -761,12 +769,10 @@ void wpa_dbus_flush_object_changed_properties(DBusConnection *con,
|
|||||||
const struct wpa_dbus_property_desc *dsc;
|
const struct wpa_dbus_property_desc *dsc;
|
||||||
int i;
|
int i;
|
||||||
|
|
||||||
eloop_cancel_timeout(flush_object_timeout_handler, con, (void *) path);
|
|
||||||
|
|
||||||
dbus_connection_get_object_path_data(con, path, (void **) &obj_desc);
|
dbus_connection_get_object_path_data(con, path, (void **) &obj_desc);
|
||||||
|
|
||||||
if (!obj_desc)
|
if (!obj_desc)
|
||||||
return;
|
return;
|
||||||
|
eloop_cancel_timeout(flush_object_timeout_handler, con, obj_desc);
|
||||||
|
|
||||||
dsc = obj_desc->properties;
|
dsc = obj_desc->properties;
|
||||||
for (dsc = obj_desc->properties, i = 0; dsc && dsc->dbus_property;
|
for (dsc = obj_desc->properties, i = 0; dsc && dsc->dbus_property;
|
||||||
@ -830,7 +836,7 @@ void wpa_dbus_mark_property_changed(struct wpas_dbus_priv *iface,
|
|||||||
iface->con, obj_desc->path)) {
|
iface->con, obj_desc->path)) {
|
||||||
eloop_register_timeout(0, WPA_DBUS_SEND_PROP_CHANGED_TIMEOUT,
|
eloop_register_timeout(0, WPA_DBUS_SEND_PROP_CHANGED_TIMEOUT,
|
||||||
flush_object_timeout_handler,
|
flush_object_timeout_handler,
|
||||||
iface->con, obj_desc->path);
|
iface->con, obj_desc);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user