extend lock's range in live_messages_notify()

The other code paths that ref or unref a transport are protected by
the DBusConnection's lock. This function already used that lock,
but for a narrower scope than the refcount manipulation.

live_messages_notify() could be triggered by unreffing messages
that originated from the same connection in a different thread.

[smcv: added commit message]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90312
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

diff --git a/dbus/dbus-transport.c b/dbus/dbus-transport.c
index f63e0ced402b1ba3bc5eaff65c37c765c29e9b4d..e9dcc5681aa4ad7dedc2335ddfae91e346a692ab 100644 (file)
--- a/dbus/dbus-transport.c
+++ b/dbus/dbus-transport.c
@@ -63,6 +63,7 @@ live_messages_notify (DBusCounter *counter,
 {
   DBusTransport *transport = user_data;
 
+  _dbus_connection_lock (transport->connection);
   _dbus_transport_ref (transport);
 
 #if 0
@@ -77,12 +78,11 @@ live_messages_notify (DBusCounter *counter,
    */
   if (transport->vtable->live_messages_changed)
     {
-      _dbus_connection_lock (transport->connection);
       (* transport->vtable->live_messages_changed) (transport);
-      _dbus_connection_unlock (transport->connection);
     }
 
   _dbus_transport_unref (transport);
+  _dbus_connection_unlock (transport->connection);
 }
 
 /**