Swiftdiff options
| author | Tobias Markmann <tm@ayena.de> | 2015-12-09 14:23:16 (GMT) |
|---|---|---|
| committer | Swift Review <review@swift.im> | 2015-12-17 11:56:38 (GMT) |
| commit | 38060b55e20bd3303c44d94cc830082bd5e5cdc7 (patch) | |
| tree | 736560757b9dcd3ad7d68a11cfe461f42e163195 /Swiften/FileTransfer/IBBSendSession.cpp | |
| parent | e9ed818dac91e280eb8da86dc8494710f1da0624 (diff) | |
| download | swift-38060b55e20bd3303c44d94cc830082bd5e5cdc7.zip swift-38060b55e20bd3303c44d94cc830082bd5e5cdc7.tar.bz2 | |
Disconnect signals from in-flight IBB request
Canceling an IBB transfer in-flight caused an use-after-free
reported by ASAN. With this fix we keep a reference of the
current request around to be able to disconnect from its
signals on cancel.
Test-Information:
Transferred a file with Swift using the IBB method and canceled
the transfer. The previously error reported by ASAN is gone.
Change-Id: I240d3dbb59cddb6b91d49f268595a89ac8805f72
Diffstat (limited to 'Swiften/FileTransfer/IBBSendSession.cpp')
| -rw-r--r-- | Swiften/FileTransfer/IBBSendSession.cpp | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/Swiften/FileTransfer/IBBSendSession.cpp b/Swiften/FileTransfer/IBBSendSession.cpp index 04c3b5e..9f41532 100644 --- a/Swiften/FileTransfer/IBBSendSession.cpp +++ b/Swiften/FileTransfer/IBBSendSession.cpp @@ -1,21 +1,21 @@ /* - * Copyright (c) 2010-2013 Isode Limited. + * Copyright (c) 2010-2015 Isode Limited. * All rights reserved. * See the COPYING file for more information. */ #include <Swiften/FileTransfer/IBBSendSession.h> #include <boost/bind.hpp> #include <boost/numeric/conversion/cast.hpp> #include <Swiften/Base/ByteArray.h> -#include <Swiften/Queries/IQRouter.h> -#include <Swiften/FileTransfer/IBBRequest.h> #include <Swiften/FileTransfer/BytestreamException.h> +#include <Swiften/FileTransfer/IBBRequest.h> +#include <Swiften/Queries/IQRouter.h> namespace Swift { IBBSendSession::IBBSendSession( const std::string& id, const JID& from, @@ -41,22 +41,28 @@ IBBSendSession::~IBBSendSession() { void IBBSendSession::start() { IBBRequest::ref request = IBBRequest::create( from, to, IBB::createIBBOpen(id, boost::numeric_cast<int>(blockSize)), router); request->onResponse.connect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); active = true; request->send(); + currentRequest = request; } void IBBSendSession::stop() { if (active && router->isAvailable()) { IBBRequest::create(from, to, IBB::createIBBClose(id), router)->send(); } + if (currentRequest) { + currentRequest->onResponse.disconnect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); + } finish(boost::optional<FileTransferError>()); } void IBBSendSession::handleIBBResponse(IBB::ref, ErrorPayload::ref error) { + currentRequest.reset(); + if (!error && active) { if (!bytestream->isFinished()) { sendMoreData(); } else { finish(boost::optional<FileTransferError>()); @@ -73,12 +79,13 @@ void IBBSendSession::sendMoreData() { if (!data->empty()) { waitingForData = false; IBBRequest::ref request = IBBRequest::create(from, to, IBB::createIBBData(id, sequenceNumber, *data), router); sequenceNumber++; request->onResponse.connect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); request->send(); + currentRequest = request; onBytesSent(data->size()); } else { waitingForData = true; } } |