[gnome-session] Fix a possible crash in the presence interface



commit 8995ac5ab232276774b326d6b36c15c6d3d9eaba
Author: Matthias Clasen <mclasen redhat com>
Date:   Fri Nov 1 16:30:06 2013 -0400

    Fix a possible crash in the presence interface
    
    Improper error handling in gsm_presence_set_status_text() would
    lead to a double free on the next call to that function.
    Found using the dfuzzer tool,
    https://github.com/matusmarhefka/dfuzzer

 gnome-session/gsm-presence.c |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)
---
diff --git a/gnome-session/gsm-presence.c b/gnome-session/gsm-presence.c
index e42745f..128cd52 100644
--- a/gnome-session/gsm-presence.c
+++ b/gnome-session/gsm-presence.c
@@ -356,6 +356,7 @@ gsm_presence_set_status_text (GsmPresence  *presence,
         g_return_val_if_fail (GSM_IS_PRESENCE (presence), FALSE);
 
         g_free (presence->priv->status_text);
+       presence->priv->status_text = NULL;
 
         /* check length */
         if (status_text != NULL && strlen (status_text) > MAX_STATUS_TEXT) {
@@ -368,11 +369,11 @@ gsm_presence_set_status_text (GsmPresence  *presence,
 
         if (status_text != NULL) {
                 presence->priv->status_text = g_strdup (status_text);
-        } else {
-                presence->priv->status_text = g_strdup ("");
         }
+
         g_object_notify (G_OBJECT (presence), "status-text");
-        g_signal_emit (presence, signals[STATUS_TEXT_CHANGED], 0, presence->priv->status_text);
+        g_signal_emit (presence, signals[STATUS_TEXT_CHANGED], 0,
+                       presence->priv->status_text ? presence->priv->status_text : "");
         return TRUE;
 }
 
@@ -448,7 +449,7 @@ gsm_presence_get_property (GObject    *object,
                 g_value_set_uint (value, self->priv->status);
                 break;
         case PROP_STATUS_TEXT:
-                g_value_set_string (value, self->priv->status_text);
+                g_value_set_string (value, self->priv->status_text ? self->priv->status_text : "");
                 break;
         case PROP_IDLE_ENABLED:
                 g_value_set_boolean (value, self->priv->idle_enabled);


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]