2007-06-05 Carlos Garnacho <carlosg@gnome.org>

        * dispatcher/dispatcher.c (get_destination): be more paranoid checking
        the destination path before creating the forwarded copy.
        (dispatch_stb_message): do not leak the copy if there was something
        wrong with the destination.

2 files changed, 19 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 8229d50..da8e472 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2007-06-05  Carlos Garnacho  <carlosg@gnome.org>
+
+	* dispatcher/dispatcher.c (get_destination): be more paranoid checking
+	the destination path before creating the forwarded copy.
+	(dispatch_stb_message): do not leak the copy if there was something
+	wrong with the destination.
+
 2007-04-09  Carlos Garnacho  <carlosg@gnome.org>
 
 	* Utils/Parse.pm (split_all_array_with_pos): only push non empty
diff --git a/dispatcher/dispatcher.c b/dispatcher/dispatcher.c
index 1e4b678..a888d4a 100644
--- a/dispatcher/dispatcher.c
+++ b/dispatcher/dispatcher.c
@@ -93,12 +93,20 @@ dispatch_reply (DBusPendingCall *pending_call,
 static gchar*
 get_destination (DBusMessage *message)
 {
-  gchar **arr, *destination;
+  gchar **arr, *destination = NULL;
 
   if (!dbus_message_get_path_decomposed (message, &arr))
     return NULL;
 
-  destination = g_strdup_printf (DBUS_INTERFACE_STB ".%s", arr[3]);
+  if (!arr)
+    return NULL;
+
+  /* paranoid check */
+  if (arr[0] && strcmp (arr[0], "org") == 0 &&
+      arr[1] && strcmp (arr[1], "freedesktop") == 0 &&
+      arr[2] && strcmp (arr[2], "SystemToolsBackends") == 0 && arr[3] && !arr[4])
+    destination = g_strdup_printf (DBUS_INTERFACE_STB ".%s", arr[3]);
+
   dbus_free_string_array (arr);
 
   return destination;
@@ -136,12 +144,13 @@ dispatch_stb_message (DBusConnection *connection,
     }
 
   destination = get_destination (message);
-  copy = dbus_message_copy (message);
 
   /* there's something wrong with the message */
   if (!destination)
     return;
 
+  copy = dbus_message_copy (message);
+
   /* forward the message to the corresponding service */
   dbus_message_set_destination (copy, destination);
   dbus_connection_send_with_reply (session_connection, copy, &pending_call, -1);