Bug 94486 - Access after free during polkitagentlistener shutdown
Summary: Access after free during polkitagentlistener shutdown
Status: RESOLVED FIXED
Alias: None
Product: PolicyKit
Classification: Unclassified
Component: libpolkit (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: David Zeuthen (not reading bugmail)
QA Contact: David Zeuthen (not reading bugmail)
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-11 09:08 UTC by Stef Walter
Modified: 2016-03-12 02:35 UTC (History)
2 users (show)

See Also:
i915 platform:
i915 features:

Attachments
polkitagent: Fix access after dereference on hashtable (1.96 KB, patch)
2016-03-11 09:08 UTC, Stef Walter 		Details | Splinter Review
View All

Description Stef Walter 2016-03-11 09:08:13 UTC 
There is an access after free during polkitagentlistener shutdown.

    If an authentication is going on while the agent listener is
    going away, then we access memory that has been freed.
    
    g_hash_table_lookup_node: assertion failed: (hash_table->ref_count > 0)'
Comment 1 Stef Walter 2016-03-11 09:08:28 UTC 
Created attachment 122217 [details] [review]
polkitagent: Fix access after dereference on hashtable

If an authentication is going on while the agent listener is
going away, then we access memory that has been freed.

g_hash_table_lookup_node: assertion failed: (hash_table->ref_count > 0)'
Comment 2 Stef Walter 2016-03-11 09:09:18 UTC 
Happens to cockpit's agent listener.
Comment 4 Colin Walters 2016-03-12 00:05:34 UTC 
Looks reasonable to me.
Comment 5 Miloslav Trmac 2016-03-12 02:35:30 UTC 
Yes, a clear improvement.

Committed, thanks!

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.