Prevent accessing destroyed AccessibilityChannel in async callbacks

flutter/shell/platform/tizen/channels/accessibility_channel.cc

@@ -39,6 +39,11 @@ static void _readCommandCallback(GObject* source_object,
 void AccessibilityChannel::OnAccessibilityBusAddressGet(GObject* source_object,
                                                         GAsyncResult* res,
                                                         gpointer user_data) {
+  if (!user_data) {
+    FT_LOG(Error) << "Accessibility channel is not available.";
+    return;
+  }
+
   g_autoptr(GError) error = nullptr;
   g_autoptr(GVariant) result = nullptr;
 
@@ -47,10 +52,17 @@ void AccessibilityChannel::OnAccessibilityBusAddressGet(GObject* source_object,
   if (error) {
     FT_LOG(Error) << "Failed to connect session bus: " << error->message;
     return;
+  } else if (!result || !g_variant_is_of_type(result, G_VARIANT_TYPE("(s)"))) {
+    FT_LOG(Error) << "Unexpected GetAddress response type.";
+    return;
   }
 
   const gchar* socket_address = nullptr;
   g_variant_get(result, "(&s)", &socket_address);
+  if (!socket_address || socket_address[0] == '\0') {
+    FT_LOG(Error) << "Could not get A11Y Bus socket address.";
+    return;
+  }
 
   auto* self = static_cast<AccessibilityChannel*>(user_data);
   self->accessibility_bus_ = g_dbus_connection_new_for_address_sync(
@@ -72,6 +84,11 @@ void AccessibilityChannel::OnAccessibilityBusAddressGet(GObject* source_object,
 void AccessibilityChannel::OnSessionBusConnection(GObject* source_object,
                                                   GAsyncResult* res,
                                                   gpointer user_data) {
+  if (!user_data) {
+    FT_LOG(Error) << "Accessibility channel is not available.";
+    return;
+  }
+
   g_autoptr(GError) error = nullptr;
   GDBusConnection* session_bus = g_bus_get_finish(res, &error);
   if (error) {
@@ -88,16 +105,17 @@ void AccessibilityChannel::OnSessionBusConnection(GObject* source_object,
   g_dbus_connection_call(
       session_bus, kAccessibilityDbus, kAccessibilityDbusPath,
       kAccessibilityDbusInterface, "GetAddress", nullptr, G_VARIANT_TYPE("(s)"),
-      G_DBUS_CALL_FLAGS_NONE, -1, nullptr,
+      G_DBUS_CALL_FLAGS_NONE, -1, self->cancellable_,
       (GAsyncReadyCallback)OnAccessibilityBusAddressGet, self);
 }
 
 AccessibilityChannel::AccessibilityChannel(BinaryMessenger* messenger)
     : channel_(std::make_unique<BasicMessageChannel<EncodableValue>>(
           messenger,
           kChannelName,
-          &StandardMessageCodec::GetInstance())) {
-  g_bus_get(G_BUS_TYPE_SESSION, nullptr,
+          &StandardMessageCodec::GetInstance())),
+      cancellable_(g_cancellable_new()) {
+  g_bus_get(G_BUS_TYPE_SESSION, cancellable_,
             (GAsyncReadyCallback)OnSessionBusConnection, this);
 
   channel_->SetMessageHandler([&](const auto& message, auto reply) {
@@ -139,6 +157,12 @@ AccessibilityChannel::AccessibilityChannel(BinaryMessenger* messenger)
 AccessibilityChannel::~AccessibilityChannel() {
   channel_->SetMessageHandler(nullptr);
 
+  if (cancellable_) {
+    g_cancellable_cancel(cancellable_);
+    g_object_unref(cancellable_);
+    cancellable_ = nullptr;
+  }
+
   if (accessibility_bus_) {
     g_object_unref(accessibility_bus_);
     accessibility_bus_ = nullptr;

flutter/shell/platform/tizen/channels/accessibility_channel.h

@@ -33,6 +33,7 @@ class AccessibilityChannel {
 
   GDBusConnection* session_bus_ = nullptr;
   GDBusConnection* accessibility_bus_ = nullptr;
+  GCancellable* cancellable_ = nullptr;
 };
 
 }  // namespace flutter