From 935243e2ab9b2025d94574b12ffd7b3dbe812412 Mon Sep 17 00:00:00 2001
From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Fri, 21 Jan 2011 14:16:50 +0000
Subject: [PATCH] test-utils: refcount ServerData

Without this change, we deserve to segfault: when the first set of
callbacks (either watches or timeouts) is cleaned up, we unref the server
and loop, and free sd; when the second set of callbacks is cleaned up, we
use-after-free sd, the server and the loop, then double-free sd.

However, due to fd.o #33277 we don't even get that far, because we've
already died with an assertion failure.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=33277
---
 test/test-utils.c |   29 +++++++++++++++++++++++------
 1 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/test/test-utils.c b/test/test-utils.c
index 67e207c..c56b6ac 100644
--- a/test/test-utils.c
+++ b/test/test-utils.c
@@ -191,21 +191,32 @@ test_connection_shutdown (DBusLoop       *loop,
 
 typedef struct
 {
+  int refcount;
   DBusLoop *loop;
   DBusServer *server;
 } ServerData;
 
 static void
-serverdata_free (void *data)
+serverdata_unref (void *data)
 {
   ServerData *sd = data;
 
+  if (--sd->refcount > 0)
+    return;
+
   dbus_server_unref (sd->server);
   _dbus_loop_unref (sd->loop);
   
   dbus_free (sd);
 }
 
+static ServerData *
+serverdata_ref (ServerData *sd)
+{
+  sd->refcount++;
+  return sd;
+}
+
 static ServerData*
 serverdata_new (DBusLoop       *loop,
                 DBusServer     *server)
@@ -216,6 +227,7 @@ serverdata_new (DBusLoop       *loop,
   if (sd == NULL)
     return NULL;
 
+  sd->refcount = 1;
   sd->loop = loop;
   sd->server = server;
 
@@ -301,9 +313,10 @@ test_server_setup (DBusLoop      *loop,
                                         add_server_watch,
                                         remove_server_watch,
                                         NULL,
-                                        sd,
-                                        serverdata_free))
+                                        serverdata_ref (sd),
+                                        serverdata_unref))
     {
+      serverdata_unref (sd);
       goto nomem;
     }
 
@@ -311,15 +324,19 @@ test_server_setup (DBusLoop      *loop,
                                           add_server_timeout,
                                           remove_server_timeout,
                                           NULL,
-                                          sd, serverdata_free))
+                                          serverdata_ref (sd),
+                                          serverdata_unref))
     {
+      serverdata_unref (sd);
       goto nomem;
-    }   
+    }
+
+  serverdata_unref (sd);
   return TRUE;
 
  nomem:
   if (sd)
-    serverdata_free (sd);
+    serverdata_unref (sd);
   
   test_server_shutdown (loop, server);
   
-- 
1.7.2.3