[gnome-user-share] obex: Fix use-after-free bug



commit a378f69ce1642e2cd56afe10a8ea298d63381a7a
Author: Bastien Nocera <hadess hadess net>
Date:   Fri Nov 8 18:45:26 2013 +0100

    obex: Fix use-after-free bug
    
    g_variant_new() will make a copy of the string for us, so there's
    no need to keep it around for the invocation. But as the invocation
    is unref'ed as soon as we return it, we'd be printing garbage in
    the "Incoming transfer authorized:" debug.

 src/obexpush.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/src/obexpush.c b/src/obexpush.c
index 24dccd4..bc8d364 100644
--- a/src/obexpush.c
+++ b/src/obexpush.c
@@ -478,7 +478,7 @@ obex_agent_authorize_push (GObject *source_object,
        g_free (download_dir);
 
        g_object_set_data_full (G_OBJECT (transfer), "filename", g_strdup (file), g_free);
-       g_object_set_data_full (G_OBJECT (invocation), "filename", file, g_free);
+       g_object_set_data_full (G_OBJECT (invocation), "filename", g_strdup (file), g_free);
 
        g_signal_connect (transfer, "g-properties-changed",
                G_CALLBACK (transfer_property_changed), NULL);
@@ -506,6 +506,7 @@ obex_agent_authorize_push (GObject *source_object,
                show_icon ();
 
                g_debug ("Incoming transfer authorized: %s", file);
+               g_free (file);
        } else {
                g_dbus_method_invocation_return_dbus_error (invocation,
                        "org.bluez.obex.Error.Rejected", "Not Authorized");


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]