[telepathy-mission-control/telepathy-mission-control-5.2] _mcd_connection_dispose: remove probation and reconnect timers explicitly

Simon McVittie simon.mcvittie at collabora.co.uk
Fri Sep 18 04:34:12 PDT 2009


The previous code was misleading. It said:

    /* Remove any pending source: timer and idle */
    g_source_remove_by_user_data (connection);

However, this has multiple flaws:
* the comment is wrong - g_source_remove_by_user_data never removes more
  than one source
* as a result, either the probation timer or the reconnect timer could be
  removed, but never both, so if both were running, we'd get a
  use-after-free
* because the McdConnection is a "publically-available" pointer, we could
  theoretically remove a timeout/idle set by someone else (the McdAccount?)
  that happened to have the McdConnection as its user_data
* even if the comment had been true, the code wouldn't have been obviously
  correct
---
 src/mcd-connection.c |   13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/mcd-connection.c b/src/mcd-connection.c
index 81f55d1..442c768 100644
--- a/src/mcd-connection.c
+++ b/src/mcd-connection.c
@@ -1862,8 +1862,17 @@ _mcd_connection_dispose (GObject * object)
 
     priv->is_disposed = TRUE;
 
-    /* Remove any pending source: timer and idle */
-    g_source_remove_by_user_data (connection);
+    if (priv->probation_timer)
+    {
+        g_source_remove (priv->probation_timer);
+        priv->probation_timer = 0;
+    }
+
+    if (priv->reconnect_timer)
+    {
+        g_source_remove (priv->reconnect_timer);
+        priv->reconnect_timer = 0;
+    }
 
     mcd_operation_foreach (MCD_OPERATION (connection),
 			   (GFunc) _foreach_channel_remove, connection);
-- 
1.5.6.5



More information about the telepathy-commits mailing list