mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-29 05:40:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

a2dp: handle source transport destroy

Browse source 
Fix a use-after-free to transport if node is still running.
This revert part of a75fe69c8e.
This commit is contained in:
Huang-Huang Bao 2021-04-15 10:01:46 +08:00 • committed by Wim Taymans
parent 4b7a2df0b7
commit d44955a199
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
spa/plugins/bluez5/a2dp-source.c
View file

@ -107,6 +107,7 @@ struct impl {
struct props props;
struct spa_bt_transport *transport;
struct spa_hook transport_listener;
struct port port;
@ -1201,6 +1202,31 @@ static const struct spa_node_methods impl_node = {
.process = impl_node_process,
};
static int do_transport_destroy(struct spa_loop *loop,
bool async,
uint32_t seq,
const void *data,
size_t size,
void *user_data)
{
struct impl *this = user_data;
this->transport = NULL;
this->transport_acquired = false;
return 0;
}
static void transport_destroy(void *data)
{
struct impl *this = data;
spa_log_debug(this->log, "transport %p destroy", this->transport);
spa_loop_invoke(this->data_loop, do_transport_destroy, 0, NULL, 0, true, this);
}
static const struct spa_bt_transport_events transport_events = {
SPA_VERSION_BT_TRANSPORT_EVENTS,
.destroy = transport_destroy,
};
static int impl_get_interface(struct spa_handle *handle, const char *type, void **interface)
{
struct impl *this;
@ -1225,6 +1251,8 @@ static int impl_clear(struct spa_handle *handle)
this->codec->deinit(this->codec_data);
if (this->codec_props && this->codec->clear_props)
this->codec->clear_props(this->codec_props);
if (this->transport)
spa_hook_remove(&this->transport_listener);
return 0;
}
@ -1329,6 +1357,9 @@ impl_init(const struct spa_handle_factory *factory,
this->codec_props = this->codec->init_props(this->codec,
this->transport->device->settings);
spa_bt_transport_add_listener(this->transport,
&this->transport_listener, &transport_events, this);
return 0;
}