plymouthd crash if plymouth ask-question, ask-for-password or watch-keystroke is killed
The plymouthd will crash if plymouth client in ask-question, ask-for-password or watch-keystroke gets killed.
What happens is as follows:
- ply-boot-server.c:ply_boot_connection_on_request() creates answer trigger and gives the connection to it as context. This is then given to main.c's callback
- main.c will store the trigger in
keystrokes_trigger
orentry_triggers
list - client connection gets killed, and ply_boot_connection_on_hangup() callback is called
- the connection is freed << requested trigger needs to get fired >>
- main.c will fire the trigger, but the connection pointer is already freed. this causes various use-after-free memory issues and double-frees. and crash occurs in one of those places.