Skip to content

Commit

Permalink
Add a test for a double-free in Gio-DBus
Browse files Browse the repository at this point in the history
The docs for g_dbus_proxy_get_interface_info() say "Do not unref the returned
object, it is owned by proxy". However, this function's return value is not
correctly annotated as transfer=none. This causes a double-free at runtime,
because lgi frees a reference that it never owned.

Because we cannot query the reference count, this test does not actually test
much. If it causes a segfault, then the test failed. This is bad behaviour for a
test, but seems to be the best that we can do.

This test uses Gio.TestDBus to create a local dbus daemon. This in turn causes
problems, because it has to make sure everything referencing that dbus daemon is
finalized before TestDBus is torn down. The implementation is careful to trigger
a GC cycle where needed to handle this.

Signed-off-by: Uli Schlachter <psychon@znc.in>
  • Loading branch information
psychon committed Oct 24, 2016
1 parent 503c5c5 commit 0c1ad04
Showing 1 changed file with 28 additions and 0 deletions.
28 changes: 28 additions & 0 deletions tests/dbus.lua
Original file line number Diff line number Diff line change
Expand Up @@ -122,3 +122,31 @@ function dbus.info_xml()
check(node.interfaces[1].properties[1].flags.READABLE)
check(node.interfaces[1].properties[1].flags.WRITABLE)
end

function dbus.proxy_get_interface_info()
local Gio = lgi.Gio

-- This test does not actually test much, it only checks for a double-free due
-- to a wrong annotation on GDBusProxy's get_interface_info()
local test_bus = Gio.TestDBus.new(Gio.TestDBusFlags.NONE)
test_bus:up()

do
local interface = Gio.DBusInterfaceInfo {
name = 'SomeInterface'
}
local bus = Gio.bus_get_sync(Gio.BusType.SESSION)
local proxy, err = Gio.DBusProxy.new_sync(bus, Gio.DBusProxyFlags.NONE, interface, "org.foo", "/", "org.foo.SomeInterface", nil)
assert(proxy, err)

local interface2 = proxy:get_interface_info()

-- Just so that we do test something
assert(interface == interface2)
end

-- Make sure the above-created objects are collected before the bus
collectgarbage("collect")

test_bus:down()
end

0 comments on commit 0c1ad04

Please sign in to comment.