Cancel outstanding channel requests if connection to the CM is lost.

When the connection to a given channel manager was lost (such as it crashed),
any outstanding channel requests were freed, but then the request callback
fired with an invalid (already freed) DispatcherRequestData parameter. It
subsequently used this invalid data and crashed.

This patch cancels all outstanding channel requests when they are freed so the
callback isn't called with invalid data. Fixes #598332

diff --git a/libempathy/empathy-dispatcher.c b/libempathy/empathy-dispatcher.c
index 57c79c2e03cfe2aeadaa31c8c5e79fc80dd15571..2655764f84606aeb8a13451a30c2c0b03d9f3e85 100644 (file)
--- a/libempathy/empathy-dispatcher.c
+++ b/libempathy/empathy-dispatcher.c
@@ -131,6 +131,7 @@ typedef struct
   guint handle_type;
   guint handle;
   EmpathyContact *contact;
+  TpProxyPendingCall *pending_call;
 
   /* Properties to pass to the channel when requesting it */
   GHashTable *request;
@@ -284,6 +285,8 @@ free_connection_data (ConnectionData *cd)
 
   for (l = cd->outstanding_requests ; l != NULL; l = g_list_delete_link (l,l))
     {
+      DispatcherRequestData *data = l->data;
+      tp_proxy_pending_call_cancel (data->pending_call);
       free_dispatcher_request_data (l->data);
     }
 
@@ -1322,7 +1325,8 @@ dispatcher_request_channel (DispatcherRequestData *request_data)
     }
   else
     {
-      tp_cli_connection_call_request_channel (request_data->connection, -1,
+      request_data->pending_call = tp_cli_connection_call_request_channel (
+        request_data->connection, -1,
         request_data->channel_type,
         request_data->handle_type,
         request_data->handle,
@@ -1481,7 +1485,8 @@ empathy_dispatcher_join_muc (TpConnection *connection,
   connection_data->outstanding_requests = g_list_prepend
     (connection_data->outstanding_requests, request_data);
 
-  tp_cli_connection_call_request_handles (connection, -1,
+  request_data->pending_call = tp_cli_connection_call_request_handles (
+    connection, -1,
     TP_HANDLE_TYPE_ROOM, names,
     dispatcher_request_handles_cb, request_data, NULL,
     G_OBJECT (dispatcher));
@@ -1527,14 +1532,16 @@ empathy_dispatcher_call_create_or_ensure_channel (
 {
   if (request_data->should_ensure)
     {
-      tp_cli_connection_interface_requests_call_ensure_channel (
+      request_data->pending_call =
+          tp_cli_connection_interface_requests_call_ensure_channel (
           request_data->connection, -1,
           request_data->request, dispatcher_ensure_channel_cb,
           request_data, NULL, G_OBJECT (request_data->dispatcher));
     }
   else
     {
-      tp_cli_connection_interface_requests_call_create_channel (
+      request_data->pending_call =
+          tp_cli_connection_interface_requests_call_create_channel (
           request_data->connection, -1,
           request_data->request, dispatcher_create_channel_cb,
           request_data, NULL, G_OBJECT (request_data->dispatcher));