[resend] [patch] dbus_connection_send_with_reply() leaking DBusPendingCalls

[Timo Teräs]

Hi.

I'm resending this since the list seems to be alive again and there hasn't
been any comments yet about this.

Also the patches are updated against todays cvs.

Feedback appreciated.

Cheers,
   Timo

-------- Original Message --------
Subject: [patch] dbus_connection_send_with_reply() leaking DBusPendingCalls
Date: Mon, 16 Feb 2004 11:21:05 +0200
From: ext Timo Teräs <ext-timo.teras at nokia.com>
To: dbus at freedesktop.org

Hi all.

I have implemented a small test server/client using the pending call
system for getting replies. Then I valgrinded it and it seemed to have
some odd memory leaks so I started digging.

It seems that the DBusPendingCall -struct isn't initialized properly in
dbus_connection_send_with_reply(). It is first allocated using
_dbus_pending_call_new (refcount=1). Then it is attached to the
onnection using _dbus_connection_attach_pending_call_unlocked() which
increases the refcount to 2. And finally if the DBusPendingCall is
returned to caller the refcount is yet increased (to 3).

When the pending call is removed it's refcount is only decreased by one
in free_pending_call_on_hash_removal(). Plus the caller should unref
once if it received the pointer. So the DBusPendingCalls allocated in
dbus_connection_send_with_reply() doesn't get freed.

See attached patch pending_call_fix.diff.


I've also been using dbus-send and noticed it lacks support to send
boolean arguments. It was also a bit weird that --print-reply doesn't
set the message type to method call since you propably won't otherwise
get any reply. A small patch for those is as follows:

See attached patch dbus_send.diff.


Cheers,
    Timo

-------------- next part --------------
A non-text attachment was scrubbed...
Name: dbus_send.diff
Type: text/x-patch
Size: 1060 bytes
Desc: not available
Url : http://freedesktop.org/pipermail/dbus/attachments/20040324/1a90b0a6/dbus_send.bin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pending_call_fix.diff
Type: text/x-patch
Size: 409 bytes
Desc: not available
Url : http://freedesktop.org/pipermail/dbus/attachments/20040324/1a90b0a6/pending_call_fix.bin