2011-07-07 12:01:39

by Dmitriy Paliy

Subject: [PATCH obexd v2 0/1] Fix invalid memory read when pulling phone book

Hi,

This patch is updated w.r.t. to Radek's comment.

BR,
Dmitriy

2011-07-10 07:49:58

by Johan Hedberg

Subject: Re: [PATCH obexd v2] Fix invalid memory read when pulling phone book

Hi Dmitriy,

On Thu, Jul 07, 2011, Dmitriy Paliy wrote:
> Data contacts are freed ones in finalize function which is called in
> query_result callback function. Calling free_data_contacts(data) twice
> for last phone book part causes invalid memory read when dereferencing
> data->contacts.
> ---
> plugins/phonebook-tracker.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)

Applied. Thanks.

Johan

2011-07-07 12:01:40

by Dmitriy Paliy

Subject: [PATCH obexd v2] Fix invalid memory read when pulling phone book

Data contacts are freed ones in finalize function which is called in
query_result callback function. Calling free_data_contacts(data) twice
for last phone book part causes invalid memory read when dereferencing
data->contacts.
---
plugins/phonebook-tracker.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/plugins/phonebook-tracker.c b/plugins/phonebook-tracker.c
index d396203..e4e7779 100644
--- a/plugins/phonebook-tracker.c
+++ b/plugins/phonebook-tracker.c
@@ -1154,7 +1154,8 @@ static void send_pull_part(struct phonebook_data *data,
data->cb(vcards->str, vcards->len, g_slist_length(data->contacts),
data->newmissedcalls, lastpart, data->user_data);

- free_data_contacts(data);
+ if (!lastpart)
+ free_data_contacts(data);
g_string_free(vcards, TRUE);
}

--
1.7.4.1