[evolution-ews] Bug 735801 - Use-after-free in e_book_backend_ews_dispose() after resume

[Milan Crha <mcrha src gnome org>]

commit ee2cd1f5a8f8d68415ad33fc57a99d4ae0f6b3c2
Author: Milan Crha <mcrha redhat com>
Date:   Mon Sep 1 16:50:00 2014 +0200

    Bug 735801 - Use-after-free in e_book_backend_ews_dispose() after resume

 src/addressbook/e-book-backend-ews.c |   35 ++++++++++++++++++-------------
 src/calendar/e-cal-backend-ews.c     |   22 +++++++------------
 src/camel/camel-ews-store-summary.c  |   19 +++++++----------
 src/server/e-ews-folder.c            |   26 ++++++-----------------
 src/server/e-ews-item.c              |   37 +++++----------------------------
 5 files changed, 49 insertions(+), 90 deletions(-)
---
diff --git a/src/addressbook/e-book-backend-ews.c b/src/addressbook/e-book-backend-ews.c
index 3315475..769b7a2 100644
--- a/src/addressbook/e-book-backend-ews.c
+++ b/src/addressbook/e-book-backend-ews.c
@@ -3967,6 +3967,7 @@ e_book_backend_ews_dispose (GObject *object)
                g_cond_clear (&priv->dlock->cond);
                g_free (priv->dlock);
                priv->dthread = NULL;
+               priv->dlock = NULL;
        }
 
        if (priv->cancellable) {
@@ -4008,12 +4009,19 @@ e_book_backend_ews_dispose (GObject *object)
                priv->summary = NULL;
        }
 
-       g_rec_mutex_clear (&priv->rec_mutex);
+       G_OBJECT_CLASS (e_book_backend_ews_parent_class)->dispose (object);
+}
 
-       g_free (priv);
-       priv = NULL;
+static void
+e_book_backend_ews_finalize (GObject *object)
+{
+       EBookBackendEws *bews;
 
-       G_OBJECT_CLASS (e_book_backend_ews_parent_class)->dispose (object);
+       bews = E_BOOK_BACKEND_EWS (object);
+
+       g_rec_mutex_clear (&bews->priv->rec_mutex);
+
+       G_OBJECT_CLASS (e_book_backend_ews_parent_class)->finalize (object);
 }
 
 static gboolean
@@ -4089,6 +4097,8 @@ e_book_backend_ews_class_init (EBookBackendEwsClass *klass)
        EBackendClass *backend_class;
        EBookBackendClass *parent_class;
 
+       g_type_class_add_private (klass, sizeof (EBookBackendEwsPrivate));
+
        backend_class = E_BACKEND_CLASS (klass);
        parent_class = E_BOOK_BACKEND_CLASS (klass);
 
@@ -4108,6 +4118,7 @@ e_book_backend_ews_class_init (EBookBackendEwsClass *klass)
 
        object_class->constructed             = e_book_backend_ews_constructed;
        object_class->dispose                 = e_book_backend_ews_dispose;
+       object_class->finalize                = e_book_backend_ews_finalize;
 }
 
 static void
@@ -4120,19 +4131,13 @@ e_book_backend_ews_authenticator_init (ESourceAuthenticatorInterface *iface)
 static void
 e_book_backend_ews_init (EBookBackendEws *backend)
 {
-       EBookBackendEws *bews;
-       EBookBackendEwsPrivate *priv;
-
-       bews = E_BOOK_BACKEND_EWS (backend);
-
-       priv = g_new0 (EBookBackendEwsPrivate, 1);
-       priv->ops = g_hash_table_new (NULL, NULL);
+       backend->priv = G_TYPE_INSTANCE_GET_PRIVATE (backend, E_TYPE_BOOK_BACKEND_EWS, 
EBookBackendEwsPrivate);
+       backend->priv->ops = g_hash_table_new (NULL, NULL);
 
-       bews->priv = priv;
-       g_rec_mutex_init (&priv->rec_mutex);
-       priv->cancellable = g_cancellable_new ();
+       g_rec_mutex_init (&backend->priv->rec_mutex);
+       backend->priv->cancellable = g_cancellable_new ();
 
        g_signal_connect (
-               bews, "notify::online",
+               backend, "notify::online",
                G_CALLBACK (e_book_backend_ews_notify_online_cb), NULL);
 }
diff --git a/src/calendar/e-cal-backend-ews.c b/src/calendar/e-cal-backend-ews.c
index df01c84..8ad7a1c 100644
--- a/src/calendar/e-cal-backend-ews.c
+++ b/src/calendar/e-cal-backend-ews.c
@@ -4197,9 +4197,6 @@ e_cal_backend_ews_finalize (GObject *object)
                priv->refreshing_done = NULL;
        }
 
-       g_free (priv);
-       cbews->priv = NULL;
-
        e_cal_backend_ews_unref_windows_zones ();
 
        G_OBJECT_CLASS (e_cal_backend_ews_parent_class)->finalize (object);
@@ -4271,6 +4268,8 @@ e_cal_backend_ews_class_init (ECalBackendEwsClass *class)
        EBackendClass *backend_class;
        ECalBackendClass *cal_backend_class;
 
+       g_type_class_add_private (class, sizeof (ECalBackendEwsPrivate));
+
        object_class = G_OBJECT_CLASS (class);
        backend_class = E_BACKEND_CLASS (class);
        cal_backend_class = E_CAL_BACKEND_CLASS (class);
@@ -4316,18 +4315,14 @@ e_cal_backend_ews_authenticator_init (ESourceAuthenticatorInterface *iface)
 static void
 e_cal_backend_ews_init (ECalBackendEws *cbews)
 {
-       ECalBackendEwsPrivate *priv;
-
-       priv = g_new0 (ECalBackendEwsPrivate, 1);
+       cbews->priv = G_TYPE_INSTANCE_GET_PRIVATE (cbews, E_TYPE_CAL_BACKEND_EWS, ECalBackendEwsPrivate);
 
        /* create the mutex for thread safety */
-       g_rec_mutex_init (&priv->rec_mutex);
-       priv->refreshing_done = e_flag_new ();
-       priv->item_id_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_object_unref);
-       priv->default_zone = icaltimezone_get_utc_timezone ();
-       priv->cancellable = g_cancellable_new ();
-
-       cbews->priv = priv;
+       g_rec_mutex_init (&cbews->priv->rec_mutex);
+       cbews->priv->refreshing_done = e_flag_new ();
+       cbews->priv->item_id_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_object_unref);
+       cbews->priv->default_zone = icaltimezone_get_utc_timezone ();
+       cbews->priv->cancellable = g_cancellable_new ();
 
        g_signal_connect (
                cbews, "notify::online",
@@ -4335,4 +4330,3 @@ e_cal_backend_ews_init (ECalBackendEws *cbews)
 
        e_cal_backend_ews_populate_windows_zones ();
 }
-
diff --git a/src/camel/camel-ews-store-summary.c b/src/camel/camel-ews-store-summary.c
index 430eeeb..f5a999a 100644
--- a/src/camel/camel-ews-store-summary.c
+++ b/src/camel/camel-ews-store-summary.c
@@ -46,8 +46,6 @@ ews_store_summary_finalize (GObject *object)
        if (priv->monitor_delete)
                g_object_unref (priv->monitor_delete);
 
-       g_free (priv);
-
        /* Chain up to parent's finalize() method. */
        G_OBJECT_CLASS (camel_ews_store_summary_parent_class)->finalize (object);
 }
@@ -57,6 +55,8 @@ camel_ews_store_summary_class_init (CamelEwsStoreSummaryClass *class)
 {
        GObjectClass *object_class;
 
+       g_type_class_add_private (class, sizeof (CamelEwsStoreSummaryPrivate));
+
        object_class = G_OBJECT_CLASS (class);
        object_class->finalize = ews_store_summary_finalize;
 }
@@ -64,16 +64,13 @@ camel_ews_store_summary_class_init (CamelEwsStoreSummaryClass *class)
 static void
 camel_ews_store_summary_init (CamelEwsStoreSummary *ews_summary)
 {
-       CamelEwsStoreSummaryPrivate *priv;
-
-       priv = g_new0 (CamelEwsStoreSummaryPrivate, 1);
-       ews_summary->priv = priv;
+       ews_summary->priv = G_TYPE_INSTANCE_GET_PRIVATE (ews_summary, CAMEL_TYPE_EWS_STORE_SUMMARY, 
CamelEwsStoreSummaryPrivate);
 
-       priv->key_file = g_key_file_new ();
-       priv->dirty = FALSE;
-       priv->fname_id_hash = g_hash_table_new (g_str_hash, g_str_equal);
-       priv->id_fname_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
-       g_rec_mutex_init (&priv->s_lock);
+       ews_summary->priv->key_file = g_key_file_new ();
+       ews_summary->priv->dirty = FALSE;
+       ews_summary->priv->fname_id_hash = g_hash_table_new (g_str_hash, g_str_equal);
+       ews_summary->priv->id_fname_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free);
+       g_rec_mutex_init (&ews_summary->priv->s_lock);
 }
 
 static gchar *build_full_name (CamelEwsStoreSummary *ews_summary, const gchar *fid)
diff --git a/src/server/e-ews-folder.c b/src/server/e-ews-folder.c
index 7834085..b4960c4 100644
--- a/src/server/e-ews-folder.c
+++ b/src/server/e-ews-folder.c
@@ -48,8 +48,6 @@ struct _EEwsFolderPrivate {
        gboolean foreign;
 };
 
-static GObjectClass *parent_class = NULL;
-
 static void
 e_ews_folder_dispose (GObject *object)
 {
@@ -57,8 +55,7 @@ e_ews_folder_dispose (GObject *object)
 
        g_return_if_fail (E_IS_EWS_FOLDER (folder));
 
-       if (parent_class->dispose)
-               (* parent_class->dispose) (object);
+       G_OBJECT_CLASS (e_ews_folder_parent_class)->dispose (object);
 }
 
 static void
@@ -92,11 +89,7 @@ e_ews_folder_finalize (GObject *object)
                priv->parent_fid = NULL;
        }
 
-       g_free (priv);
-       folder->priv = NULL;
-
-       if (parent_class->finalize)
-               (* parent_class->finalize) (object);
+       G_OBJECT_CLASS (e_ews_folder_parent_class)->finalize (object);
 }
 
 static void
@@ -104,7 +97,7 @@ e_ews_folder_class_init (EEwsFolderClass *klass)
 {
        GObjectClass *object_class = G_OBJECT_CLASS (klass);
 
-       parent_class = g_type_class_peek_parent (klass);
+       g_type_class_add_private (klass, sizeof (EEwsFolderPrivate));
 
        object_class->dispose = e_ews_folder_dispose;
        object_class->finalize = e_ews_folder_finalize;
@@ -113,15 +106,10 @@ e_ews_folder_class_init (EEwsFolderClass *klass)
 static void
 e_ews_folder_init (EEwsFolder *folder)
 {
-       EEwsFolderPrivate *priv;
-
-       /* allocate internal structure */
-       priv = g_new0 (EEwsFolderPrivate, 1);
-       folder->priv = priv;
-
-       priv->error = NULL;
-       priv->folder_type = E_EWS_FOLDER_TYPE_UNKNOWN;
-       priv->foreign = FALSE;
+       folder->priv = G_TYPE_INSTANCE_GET_PRIVATE (folder, E_TYPE_EWS_FOLDER, EEwsFolderPrivate);
+       folder->priv->error = NULL;
+       folder->priv->folder_type = E_EWS_FOLDER_TYPE_UNKNOWN;
+       folder->priv->foreign = FALSE;
 }
 
 static gboolean
diff --git a/src/server/e-ews-item.c b/src/server/e-ews-item.c
index fa118c5..73ddea5 100644
--- a/src/server/e-ews-item.c
+++ b/src/server/e-ews-item.c
@@ -148,7 +148,6 @@ struct _EEwsItemPrivate {
        struct _EEwsTaskFields *task_fields;
 };
 
-static GObjectClass *parent_class = NULL;
 static void    ews_item_free_attendee (EwsAttendee *attendee);
 static void    ews_free_contact_fields (struct _EEwsContactFields *con_fields);
 
@@ -273,26 +272,7 @@ e_ews_item_dispose (GObject *object)
        g_slist_free_full (priv->categories, g_free);
        priv->categories = NULL;
 
-       if (parent_class->dispose)
-               (* parent_class->dispose) (object);
-}
-
-static void
-e_ews_item_finalize (GObject *object)
-{
-       EEwsItem *item = (EEwsItem *) object;
-       EEwsItemPrivate *priv;
-
-       g_return_if_fail (E_IS_EWS_ITEM (item));
-
-       priv = item->priv;
-
-       /* clean up */
-       g_free (priv);
-       item->priv = NULL;
-
-       if (parent_class->finalize)
-               (* parent_class->finalize) (object);
+       G_OBJECT_CLASS (e_ews_item_parent_class)->dispose (object);
 }
 
 static void
@@ -300,25 +280,20 @@ e_ews_item_class_init (EEwsItemClass *klass)
 {
        GObjectClass *object_class = G_OBJECT_CLASS (klass);
 
-       parent_class = g_type_class_peek_parent (klass);
+       g_type_class_add_private (klass, sizeof (EEwsItemPrivate));
 
        object_class->dispose = e_ews_item_dispose;
-       object_class->finalize = e_ews_item_finalize;
 }
 
 static void
 e_ews_item_init (EEwsItem *item)
 {
-       EEwsItemPrivate *priv;
-
-       /* allocate internal structure */
-       priv = g_new0 (EEwsItemPrivate, 1);
-       item->priv = priv;
+       item->priv = G_TYPE_INSTANCE_GET_PRIVATE (item, E_TYPE_EWS_ITEM, EEwsItemPrivate);
 
-       priv->item_type = E_EWS_ITEM_TYPE_UNKNOWN;
+       item->priv->item_type = E_EWS_ITEM_TYPE_UNKNOWN;
 
-       priv->mapi_extended_tags = g_hash_table_new_full (g_direct_hash, g_direct_equal, NULL, g_free);
-       priv->mapi_extended_sets = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, (GDestroyNotify) 
g_hash_table_destroy);
+       item->priv->mapi_extended_tags = g_hash_table_new_full (g_direct_hash, g_direct_equal, NULL, g_free);
+       item->priv->mapi_extended_sets = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, 
(GDestroyNotify) g_hash_table_destroy);
 }
 
 static void