[evolution-data-server] [Weather Calendar] Weather info source never freed



commit a06764de0b6f80ca8fbac2b3849ff522b2b2a105
Author: Milan Crha <mcrha redhat com>
Date:   Wed Feb 19 18:43:44 2014 +0100

    [Weather Calendar] Weather info source never freed
    
    The priv->source was allocated, but never freed, especially after
    the weather backend was freed, which might cause use-after-free
    in the finished_retrieval_cb() callback, when the weather backend
    was freed during the data update.
    
    This might be the cause of a crash reported at:
    https://bugzilla.redhat.com/show_bug.cgi?id=1065796

 calendar/backends/weather/e-cal-backend-weather.c |   25 +++++++++++++++++---
 1 files changed, 21 insertions(+), 4 deletions(-)
---
diff --git a/calendar/backends/weather/e-cal-backend-weather.c 
b/calendar/backends/weather/e-cal-backend-weather.c
index a117f10..7a5416a 100644
--- a/calendar/backends/weather/e-cal-backend-weather.c
+++ b/calendar/backends/weather/e-cal-backend-weather.c
@@ -780,19 +780,35 @@ e_cal_backend_weather_notify_online_cb (ECalBackend *backend,
                e_cal_backend_set_writable (backend, FALSE);
 }
 
-/* Finalize handler for the weather backend */
 static void
-e_cal_backend_weather_finalize (GObject *object)
+e_cal_backend_weather_dispose (GObject *object)
 {
        ECalBackendWeatherPrivate *priv;
 
        priv = E_CAL_BACKEND_WEATHER_GET_PRIVATE (object);
 
-       if (priv->reload_timeout_id)
+       if (priv->reload_timeout_id) {
                g_source_remove (priv->reload_timeout_id);
+               priv->reload_timeout_id = 0;
+       }
 
-       if (priv->begin_retrival_id)
+       if (priv->begin_retrival_id) {
                g_source_remove (priv->begin_retrival_id);
+               priv->begin_retrival_id = 0;
+       }
+
+       g_clear_object (&priv->source);
+
+       /* Chain up to parent's dispose() method. */
+       G_OBJECT_CLASS (e_cal_backend_weather_parent_class)->dispose (object);
+}
+
+static void
+e_cal_backend_weather_finalize (GObject *object)
+{
+       ECalBackendWeatherPrivate *priv;
+
+       priv = E_CAL_BACKEND_WEATHER_GET_PRIVATE (object);
 
        if (priv->store) {
                g_object_unref (priv->store);
@@ -828,6 +844,7 @@ e_cal_backend_weather_class_init (ECalBackendWeatherClass *class)
        backend_class = (ECalBackendClass *) class;
        sync_class = (ECalBackendSyncClass *) class;
 
+       object_class->dispose = e_cal_backend_weather_dispose;
        object_class->finalize = e_cal_backend_weather_finalize;
 
        /* Execute one method at a time. */


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]