Swiftdiff options
| author | Tobias Markmann <tm@ayena.de> | 2015-12-09 14:23:16 (GMT) |
|---|---|---|
| committer | Swift Review <review@swift.im> | 2015-12-17 11:56:38 (GMT) |
| commit | 38060b55e20bd3303c44d94cc830082bd5e5cdc7 (patch) | |
| tree | 736560757b9dcd3ad7d68a11cfe461f42e163195 /Swiften | |
| parent | e9ed818dac91e280eb8da86dc8494710f1da0624 (diff) | |
| download | swift-38060b55e20bd3303c44d94cc830082bd5e5cdc7.zip swift-38060b55e20bd3303c44d94cc830082bd5e5cdc7.tar.bz2 | |
Disconnect signals from in-flight IBB request
Canceling an IBB transfer in-flight caused an use-after-free
reported by ASAN. With this fix we keep a reference of the
current request around to be able to disconnect from its
signals on cancel.
Test-Information:
Transferred a file with Swift using the IBB method and canceled
the transfer. The previously error reported by ASAN is gone.
Change-Id: I240d3dbb59cddb6b91d49f268595a89ac8805f72
Diffstat (limited to 'Swiften')
| -rw-r--r-- | Swiften/FileTransfer/IBBSendSession.cpp | 13 | ||||
| -rw-r--r-- | Swiften/FileTransfer/IBBSendSession.h | 12 |
2 files changed, 17 insertions, 8 deletions
diff --git a/Swiften/FileTransfer/IBBSendSession.cpp b/Swiften/FileTransfer/IBBSendSession.cpp index 04c3b5e..9f41532 100644 --- a/Swiften/FileTransfer/IBBSendSession.cpp +++ b/Swiften/FileTransfer/IBBSendSession.cpp @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010-2013 Isode Limited. + * Copyright (c) 2010-2015 Isode Limited. * All rights reserved. * See the COPYING file for more information. */ @@ -10,9 +10,9 @@ #include <boost/numeric/conversion/cast.hpp> #include <Swiften/Base/ByteArray.h> -#include <Swiften/Queries/IQRouter.h> -#include <Swiften/FileTransfer/IBBRequest.h> #include <Swiften/FileTransfer/BytestreamException.h> +#include <Swiften/FileTransfer/IBBRequest.h> +#include <Swiften/Queries/IQRouter.h> namespace Swift { @@ -44,16 +44,22 @@ void IBBSendSession::start() { request->onResponse.connect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); active = true; request->send(); + currentRequest = request; } void IBBSendSession::stop() { if (active && router->isAvailable()) { IBBRequest::create(from, to, IBB::createIBBClose(id), router)->send(); } + if (currentRequest) { + currentRequest->onResponse.disconnect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); + } finish(boost::optional<FileTransferError>()); } void IBBSendSession::handleIBBResponse(IBB::ref, ErrorPayload::ref error) { + currentRequest.reset(); + if (!error && active) { if (!bytestream->isFinished()) { sendMoreData(); @@ -76,6 +82,7 @@ void IBBSendSession::sendMoreData() { sequenceNumber++; request->onResponse.connect(boost::bind(&IBBSendSession::handleIBBResponse, this, _1, _2)); request->send(); + currentRequest = request; onBytesSent(data->size()); } else { diff --git a/Swiften/FileTransfer/IBBSendSession.h b/Swiften/FileTransfer/IBBSendSession.h index 3b29c23..af8cc12 100644 --- a/Swiften/FileTransfer/IBBSendSession.h +++ b/Swiften/FileTransfer/IBBSendSession.h @@ -1,24 +1,25 @@ /* - * Copyright (c) 2010-2013 Isode Limited. + * Copyright (c) 2010-2015 Isode Limited. * All rights reserved. * See the COPYING file for more information. */ #pragma once -#include <boost/shared_ptr.hpp> #include <boost/optional.hpp> +#include <boost/shared_ptr.hpp> #include <Swiften/Base/API.h> #include <Swiften/Base/boost_bsignals.h> -#include <Swiften/FileTransfer/ReadBytestream.h> -#include <Swiften/JID/JID.h> -#include <Swiften/Elements/IBB.h> #include <Swiften/Elements/ErrorPayload.h> +#include <Swiften/Elements/IBB.h> #include <Swiften/FileTransfer/FileTransferError.h> +#include <Swiften/FileTransfer/ReadBytestream.h> +#include <Swiften/JID/JID.h> namespace Swift { class IQRouter; + class IBBRequest; class SWIFTEN_API IBBSendSession { public: @@ -64,5 +65,6 @@ namespace Swift { int sequenceNumber; bool active; bool waitingForData; + boost::shared_ptr<IBBRequest> currentRequest; }; } |