From e08dead55d037ff4978560bbedcc780f78dc2d90 Mon Sep 17 00:00:00 2001
From: Kalev Lember <klember@redhat.com>
Date: Thu, 15 Oct 2015 09:46:13 +0200
Subject: [PATCH] file monitor: Fix invalid read

---
 0001-file-monitor-Fix-invalid-read.patch | 82 ++++++++++++++++++++++++
 gvfs.spec                                |  8 ++-
 2 files changed, 89 insertions(+), 1 deletion(-)
 create mode 100644 0001-file-monitor-Fix-invalid-read.patch

diff --git a/0001-file-monitor-Fix-invalid-read.patch b/0001-file-monitor-Fix-invalid-read.patch
new file mode 100644
index 0000000..66fa7a2
--- /dev/null
+++ b/0001-file-monitor-Fix-invalid-read.patch
@@ -0,0 +1,82 @@
+From 44d48ebfc3f322dc73d6a0b7b2bf92bdb3e905ee Mon Sep 17 00:00:00 2001
+From: Ondrej Holy <oholy@redhat.com>
+Date: Tue, 13 Oct 2015 12:37:10 +0200
+Subject: [PATCH] file monitor: Fix invalid read
+
+Commit 7373acf changed file monitor construction to be really
+synchronous. Unfortunately there is missing g_object_ref for d-bus
+connection and the connection is unrefed after use. Subsequent read
+of the unrefed connection cause crash with following critical:
+
+(firefox:29844): GLib-GIO-CRITICAL **: g_dbus_connection_is_closed:
+assertion 'G_IS_DBUS_CONNECTION (connection)' failed
+
+Do not store the connection, because it isn't neccesary with the
+synchronous construction.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=756153
+---
+ client/gdaemonfilemonitor.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/client/gdaemonfilemonitor.c b/client/gdaemonfilemonitor.c
+index 313b06f..2d9f958 100644
+--- a/client/gdaemonfilemonitor.c
++++ b/client/gdaemonfilemonitor.c
+@@ -46,7 +46,6 @@ struct _GDaemonFileMonitor
+   char *object_path;
+   char *remote_obj_path;
+   char *remote_id;
+-  GDBusConnection *connection;
+   GVfsDBusMonitor *proxy;              /* Non-null if we're subscribed */
+   GVfsDBusMonitorClient *skeleton;
+ };
+@@ -68,8 +67,6 @@ g_daemon_file_monitor_finalize (GObject* object)
+ 
+   g_clear_object (&daemon_monitor->proxy);
+ 
+-  g_clear_object (&daemon_monitor->connection);
+-
+   g_free (daemon_monitor->object_path);
+   g_free (daemon_monitor->remote_id);
+   g_free (daemon_monitor->remote_obj_path);
+@@ -157,7 +154,6 @@ subscribe_cb (GVfsDBusMonitor *proxy,
+       gvfs_dbus_monitor_call_unsubscribe (proxy,
+                                           monitor->object_path,
+                                           NULL, NULL, NULL);
+-      g_clear_object (&monitor->connection);
+       g_object_unref (monitor);
+       return;
+     }
+@@ -181,8 +177,8 @@ g_daemon_file_monitor_new (const char *remote_id,
+   daemon_monitor->remote_id = g_strdup (remote_id);
+   daemon_monitor->remote_obj_path = g_strdup (remote_obj_path);
+ 
+-  daemon_monitor->connection = _g_dbus_connection_get_sync (daemon_monitor->remote_id, NULL, &error);
+-  if (daemon_monitor->connection == NULL)
++  connection = _g_dbus_connection_get_sync (daemon_monitor->remote_id, NULL, &error);
++  if (connection == NULL)
+     {
+       g_printerr ("Error getting connection for monitoring: %s (%s, %d)\n",
+                   error->message, g_quark_to_string (error->domain), error->code);
+@@ -191,7 +187,7 @@ g_daemon_file_monitor_new (const char *remote_id,
+   else
+     {
+       if (!g_dbus_interface_skeleton_export (G_DBUS_INTERFACE_SKELETON (daemon_monitor->skeleton),
+-                                             daemon_monitor->connection,
++                                             connection,
+                                              daemon_monitor->object_path,
+                                              &error))
+         {
+@@ -202,7 +198,7 @@ g_daemon_file_monitor_new (const char *remote_id,
+ 
+       /* This looks like a sync call, but since the remote_id is a
+          unique id we don't actually send any messages */
+-      proxy = gvfs_dbus_monitor_proxy_new_sync (daemon_monitor->connection,
++      proxy = gvfs_dbus_monitor_proxy_new_sync (connection,
+                                                 G_DBUS_PROXY_FLAGS_DO_NOT_LOAD_PROPERTIES | G_DBUS_PROXY_FLAGS_DO_NOT_CONNECT_SIGNALS,
+                                                 daemon_monitor->remote_id,
+                                                 daemon_monitor->remote_obj_path,
+-- 
+2.5.0
+
diff --git a/gvfs.spec b/gvfs.spec
index 45ae8ff..26e1755 100644
--- a/gvfs.spec
+++ b/gvfs.spec
@@ -3,7 +3,7 @@
 
 Name: gvfs
 Version: 1.26.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 Summary: Backends for the gio framework in GLib
 
 License: GPLv3 and LGPLv2+ and BSD and MPLv2.0
@@ -12,6 +12,8 @@ Source0: http://download.gnome.org/sources/gvfs/1.26/gvfs-%{version}.tar.xz
 
 # http://bugzilla.gnome.org/show_bug.cgi?id=567235
 Patch0: gvfs-archive-integration.patch
+# Backported from upstream
+Patch1: 0001-file-monitor-Fix-invalid-read.patch
 
 BuildRequires: pkgconfig
 BuildRequires: glib2-devel >= %{glib2_version}
@@ -184,6 +186,7 @@ the functionality of the installed gvfs package.
 %prep
 %setup -q
 %patch0 -p1 -b .archive-integration
+%patch1 -p1
 
 # Needed for gvfs-0.2.1-archive-integration.patch
 autoreconf -fi
@@ -375,6 +378,9 @@ killall -USR1 gvfsd >&/dev/null || :
 %{_datadir}/installed-tests
 
 %changelog
+* Thu Oct 15 2015 Kalev Lember <klember@redhat.com> - 1.26.1-2
+- file monitor: Fix invalid read
+
 * Mon Oct 12 2015 Kalev Lember <klember@redhat.com> - 1.26.1-1
 - Update to 1.26.1