From 8328cc280dccac7df8df7b0d5e10d6bdc5fd7938 Mon Sep 17 00:00:00 2001 From: Philippe Proulx Date: Mon, 16 Apr 2018 18:47:39 -0400 Subject: [PATCH] Fix: bt_stream_common_finalize(): check `stream->destroy_listeners` Issue ===== In bt_stream_common_finalize(), `stream->destroy_listeners` is not checked before calling iterating the array to call the destroy listeners. This can happen if the stream is partially initialized and then destroyed when there's an error in bt_stream_common_initialize(). Solution ======== Check `stream->destroy_listeners` before iterating the destroy listener array. Known drawbacks =============== None. Signed-off-by: Philippe Proulx --- lib/ctf-ir/stream.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/ctf-ir/stream.c b/lib/ctf-ir/stream.c index 2787230c..70030454 100644 --- a/lib/ctf-ir/stream.c +++ b/lib/ctf-ir/stream.c @@ -52,14 +52,16 @@ void bt_stream_common_finalize(struct bt_stream_common *stream) stream, bt_stream_common_get_name(stream)); /* Call destroy listeners in reverse registration order */ - for (i = stream->destroy_listeners->len - 1; i >= 0; i--) { - struct bt_stream_common_destroy_listener *listener = - &g_array_index(stream->destroy_listeners, - struct bt_stream_common_destroy_listener, i); - - BT_LOGD("Calling destroy listener: func=%p, data=%p, index=%d", - listener->func, listener->data, i); - listener->func(stream, listener->data); + if (stream->destroy_listeners) { + for (i = stream->destroy_listeners->len - 1; i >= 0; i--) { + struct bt_stream_common_destroy_listener *listener = + &g_array_index(stream->destroy_listeners, + struct bt_stream_common_destroy_listener, i); + + BT_LOGD("Calling destroy listener: func=%p, data=%p, index=%d", + listener->func, listener->data, i); + listener->func(stream, listener->data); + } } if (stream->name) { -- 2.34.1