Prevent a crash in some applications due to timers leaking after the

DVusPendingCall object was freed.

    * dbus-connection.c: Remove the timer for the pending call's timeout in
      case the reply has timed out in blocking code. This fixes bug 15684.

diff --git a/dbus/dbus-connection.c b/dbus/dbus-connection.c
index 3a1670ca1d197c74b1322fd45c3945775ca0fa2e..7b13b2498233a15edfd4ffcb7c07db5b51291ec9 100644 (file)
--- a/dbus/dbus-connection.c
+++ b/dbus/dbus-connection.c
@@ -965,6 +965,13 @@ _dbus_connection_detach_pending_call_and_unlock (DBusConnection  *connection,
   _dbus_pending_call_ref_unlocked (pending);
   _dbus_hash_table_remove_int (connection->pending_replies,
                                _dbus_pending_call_get_reply_serial_unlocked (pending));
+
+  if (_dbus_pending_call_is_timeout_added_unlocked (pending))
+      _dbus_connection_remove_timeout_unlocked (connection,
+              _dbus_pending_call_get_timeout_unlocked (pending));
+
+  _dbus_pending_call_set_timeout_added_unlocked (pending, FALSE);
+
   _dbus_pending_call_unref_and_unlock (pending);
 }