[gnome-desktop/gnome-3-8] GnomeIdleMonitor: don't access watch structure after it is freed



commit d96f350a378a13cd230daf54524d89765b1a1135
Author: Giovanni Campagna <gcampagna src gnome org>
Date:   Wed Mar 27 17:45:38 2013 +0100

    GnomeIdleMonitor: don't access watch structure after it is freed
    
    The contents of the watch structure will become garbage after the
    structure is freed, causing us to unref an invalid pointer and
    potentially segfault.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=696719

 libgnome-desktop/gnome-idle-monitor.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)
---
diff --git a/libgnome-desktop/gnome-idle-monitor.c b/libgnome-desktop/gnome-idle-monitor.c
index b623f36..aa87caa 100644
--- a/libgnome-desktop/gnome-idle-monitor.c
+++ b/libgnome-desktop/gnome-idle-monitor.c
@@ -138,12 +138,14 @@ fire_watch (gpointer data,
 {
        GnomeIdleMonitorWatch *watch = data;
        XSyncAlarm alarm = (XSyncAlarm) user_data;
+       GnomeIdleMonitor *monitor;
 
        if (watch->xalarm != alarm) {
                return;
        }
 
-       g_object_ref (watch->monitor);
+       monitor = watch->monitor;
+       g_object_ref (monitor);
 
        if (watch->callback) {
                watch->callback (watch->monitor,
@@ -151,11 +153,11 @@ fire_watch (gpointer data,
                                 watch->user_data);
        }
 
-       if (watch->xalarm == watch->monitor->priv->user_active_alarm) {
-               gnome_idle_monitor_remove_watch (watch->monitor, watch->id);
+       if (watch->xalarm == monitor->priv->user_active_alarm) {
+               gnome_idle_monitor_remove_watch (monitor, watch->id);
        }
 
-       g_object_unref (watch->monitor);
+       g_object_unref (monitor);
 }
 
 static void


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]