[gnome-settings-daemon/gnome-3-16] wacom: Fix possible double-free in LED helper



commit 801be317cb445683bc88f5888975717d00e8f246
Author: Bastien Nocera <hadess hadess net>
Date:   Tue May 26 11:53:26 2015 +0200

    wacom: Fix possible double-free in LED helper
    
    From coverity:
    gnome-settings-daemon-3.14.4/plugins/wacom/gsd-wacom-led-helper.c:130: double_free: Calling "g_free" 
frees pointer "status" which has already been freed.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=749882

 plugins/wacom/gsd-wacom-led-helper.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/plugins/wacom/gsd-wacom-led-helper.c b/plugins/wacom/gsd-wacom-led-helper.c
index 2f558ee..5aed347 100644
--- a/plugins/wacom/gsd-wacom-led-helper.c
+++ b/plugins/wacom/gsd-wacom-led-helper.c
@@ -103,6 +103,7 @@ get_led_sys_path (GUdevClient *client,
                        goto no_parent;
                status = g_strdup_printf ("status_led%d_select", group_num);
                filename = g_build_filename (g_udev_device_get_sysfs_path (parent), "wacom_led", status, 
NULL);
+               g_free (status);
 
                *write_value = led_num;
         } else {
@@ -119,6 +120,7 @@ get_led_sys_path (GUdevClient *client,
                        if (g_strrstr (dev_uniq, dev_hid_uniq)){
                                status = g_strdup_printf ("/leds/%s:selector:%i/brightness", 
g_udev_device_get_name (hid_dev), led_num);
                                filename = g_build_filename (g_udev_device_get_sysfs_path (hid_dev), status, 
NULL);
+                               g_free (status);
                                break;
                        }
                        element = g_list_next(element);
@@ -127,7 +129,6 @@ get_led_sys_path (GUdevClient *client,
 
                *write_value = LED_BRIGHTNESS;
        }
-       g_free (status);
 
        g_object_unref (parent);
 


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]