https://bugs.kde.org/show_bug.cgi?id=525109

Nathaniel Eliot <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |CONFIRMED
                 CC|                            |[email protected]

--- Comment #9 from Nathaniel Eliot <[email protected]> ---
The crash is a use-after-free in bluez-qt.
ObexTransferPrivate::propertiesChanged() handles Status=complete before
Transferred from the same D-Bus signal. bluedevil's SendFilesJob reacts to
Complete by starting the next file and dropping its reference to the transfer,
which frees it while the loop is still running. The Transferred update that
follows then emits through freed memory. That's why only multi-file sends
crash.

Fix: https://invent.kde.org/frameworks/bluez-qt/-/merge_requests/94

Tested on Kubuntu 26.04 (bluedevil 6.6.4, bluez-qt 6.24.0 with the patch): a
12-file send to an Android phone completed without crashing. Without the patch
it crashed after the first file every time.

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to