[gnome-desktop] GnomeIdleMonitor: don't access watch structure after it is freed



commit 79152ba3209d46413e2d1e54272c4bfc86086e0d
Author: Giovanni Campagna <gcampagna src gnome org>
Date:   Wed Mar 27 17:45:38 2013 +0100

    GnomeIdleMonitor: don't access watch structure after it is freed
    
    The contents of the watch structure will become garbage after the
    structure is freed, causing us to unref an invalid pointer and
    potentially segfault.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=696719

 libgnome-desktop/gnome-idle-monitor.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)
---
diff --git a/libgnome-desktop/gnome-idle-monitor.c b/libgnome-desktop/gnome-idle-monitor.c
index bc21736..2f0d969 100644
--- a/libgnome-desktop/gnome-idle-monitor.c
+++ b/libgnome-desktop/gnome-idle-monitor.c
@@ -138,12 +138,14 @@ fire_watch (gpointer data,
 {
        GnomeIdleMonitorWatch *watch = data;
        XSyncAlarm alarm = (XSyncAlarm) user_data;
+       GnomeIdleMonitor *monitor;
 
        if (watch->xalarm != alarm) {
                return;
        }
 
-       g_object_ref (watch->monitor);
+       monitor = watch->monitor;
+       g_object_ref (monitor);
 
        if (watch->callback) {
                watch->callback (watch->monitor,
@@ -151,11 +153,11 @@ fire_watch (gpointer data,
                                 watch->user_data);
        }
 
-       if (watch->xalarm == watch->monitor->priv->user_active_alarm) {
-               gnome_idle_monitor_remove_watch (watch->monitor, watch->id);
+       if (watch->xalarm == monitor->priv->user_active_alarm) {
+               gnome_idle_monitor_remove_watch (monitor, watch->id);
        }
 
-       g_object_unref (watch->monitor);
+       g_object_unref (monitor);
 }
 
 static void


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]