[gnome-todo] eds: avoid crash due usage of dangling pointer



commit f4a6e4f55dfa54a0a1adcc0fafaf71c1aa36d881
Author: Victor Toso <me victortoso com>
Date:   Thu Oct 27 17:36:05 2016 +0200

    eds: avoid crash due usage of dangling pointer
    
    as g_list_remove() frees GList* l is being used after free here.
    
    Thread 1 "gnome-todo" received signal SIGSEGV, Segmentation fault.
    in type_get_qdata_L (node=0x7dce00, quark=1) at /glib/gobject/gtype.c:3656
    3656              if (quark == check->quark)
    
    (gdb) bt
     #0 in type_get_qdata_L (node=0x7dce00, quark=1) at /glib/gobject/gtype.c:3656
     #1 in type_check_is_value_type_U (type=8244736) at /glib/gobject/gtype.c:4164
     #2 in g_type_check_is_value_type (type=8244736) at /glib/gobject/gtype.c:4191
     #3 in g_value_type_compatible (src_type=8244736, dest_type=8079872) at
        /glib/gobject/gvalue.c:567
     #4 in g_value_object_collect_value (value=0x7fffffffbb78, n_collect_values=1,
        collect_values=0x7fffffffbbf0, collect_flags=0)
        at /glib/gobject/gobject.c:3669
     #5 in g_signal_emit_valist (instance=0xab4130, signal_id=262, detail=0,
        var_args=0x7fffffffbe28) at /glib/gobject/gsignal.c:3369
     #6 in g_signal_emit_by_name (instance=0xab4130,
        detailed_signal=0x43e446 "provider-removed")
        at /glib/gobject/gsignal.c:3487
     #7 in gtd_plugin_eds_goa_account_removed_cb (client=0x7fffd001cb80,
        object=0x7fffc8002420, self=0xab4130) at gtd-plugin-eds.c:153
    
    Signed-off-by: Victor Toso <victortoso redhat com>
    
    https://bugzilla.gnome.org/show_bug.cgi?id=773590

 plugins/eds/gtd-plugin-eds.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)
---
diff --git a/plugins/eds/gtd-plugin-eds.c b/plugins/eds/gtd-plugin-eds.c
index edca47c..1ad2df5 100644
--- a/plugins/eds/gtd-plugin-eds.c
+++ b/plugins/eds/gtd-plugin-eds.c
@@ -147,9 +147,10 @@ gtd_plugin_eds_goa_account_removed_cb (GoaClient    *client,
 
       if (account == gtd_provider_goa_get_account (l->data))
         {
+          GtdProviderGoa *provider = GTD_PROVIDER_GOA (l->data);
           self->providers = g_list_remove (self->providers, l->data);
 
-          g_signal_emit_by_name (self, "provider-removed", l->data);
+          g_signal_emit_by_name (self, "provider-removed", provider);
           break;
         }
     }


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]