diff options
| author | Aleksander Morgado <aleksander@lanedo.com> | 2012-07-20 12:26:28 +0200 |
|---|---|---|
| committer | Aleksander Morgado <aleksander@lanedo.com> | 2012-08-06 20:07:26 +0200 |
| commit | 40730b115e3aa7f744f6e0c72772c8a4f1872695 (patch) | |
| tree | 2667a347e872ca251f7a5cb4d53cc43ed767accb /plugins/option | |
| parent | 63a45f808260f3138b595bf9b250d2a212cb83d4 (diff) | |
hso: avoid highly unlikely use of already unref-ed bearer
In the connection sequence, we make sure that the Bearer object is valid by
keeping a reference in the Dial3gppContext (actually, another one kept by the
GSimpleAsyncResult as well). But we are considering here the case where the
connection context is completed and freed by an unsolicited message handler
before we get the reply to the AT command, so to properly ensure that the bearer
object is still valid when we try to check if the context is in the priv struct,
we need to keep an extra ref around.
Diffstat (limited to 'plugins/option')
| -rw-r--r-- | plugins/option/mm-broadband-bearer-hso.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/plugins/option/mm-broadband-bearer-hso.c b/plugins/option/mm-broadband-bearer-hso.c index 0d163024..ed82e0ed 100644 --- a/plugins/option/mm-broadband-bearer-hso.c +++ b/plugins/option/mm-broadband-bearer-hso.c @@ -465,6 +465,9 @@ activate_ready (MMBaseModem *modem, * context was already completed and we have nothing else to do. */ ctx = self->priv->connect_pending; + /* Balance refcount with the extra ref we passed to command_full() */ + g_object_unref (self); + if (!ctx) { mm_dbg ("Connection context was finished already by an unsolicited message"); @@ -536,7 +539,7 @@ authenticate_ready (MMBaseModem *modem, FALSE, NULL, /* cancellable */ (GAsyncReadyCallback)activate_ready, - ctx->self); /* we pass the bearer object! */ + g_object_ref (ctx->self)); /* we pass the bearer object! */ g_free (command); } |