[gedit] Fix use-after-free during incremental search



commit f8508ca201e7d16fa5e18a6130f456fdd3fc0c99
Author: Dan Williams <dcbw redhat com>
Date:   Wed May 25 09:58:29 2011 -0500

    Fix use-after-free during incremental search
    
    Move the free right before the assignment to ensure that
    old_search_text is never left dangling and thus double-freed
    if init_search_entry() is called again.
    
    Fixes https://bugzilla.gnome.org/show_bug.cgi?id=651068

 gedit/gedit-view-frame.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)
---
diff --git a/gedit/gedit-view-frame.c b/gedit/gedit-view-frame.c
index 5826010..670b2b0 100644
--- a/gedit/gedit-view-frame.c
+++ b/gedit/gedit-view-frame.c
@@ -1237,8 +1237,6 @@ init_search_entry (GeditViewFrame *frame)
 		guint     old_find_flags = 0;
 		gint      sel_len = 0;
 
-		g_free (frame->priv->old_search_text);
-
 		old_find_text = gedit_document_get_search_text (GEDIT_DOCUMENT (buffer),
 		                                                &old_find_flags);
 
@@ -1260,6 +1258,7 @@ init_search_entry (GeditViewFrame *frame)
 		}
 		else if (old_find_text != NULL)
 		{
+			g_free (frame->priv->old_search_text);
 			frame->priv->old_search_text = old_find_text;
 			add_search_completion_entry (old_find_text);
 			g_signal_handler_block (frame->priv->search_entry,



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]