[gimp] app: avoid potential use-after-free during GimpDashboard destruction



commit 822386f551b256aed382ed02e5bf1a0c44037724
Author: Ell <ell_se yahoo com>
Date:   Mon Dec 25 13:10:47 2017 -0500

    app: avoid potential use-after-free during GimpDashboard destruction
    
    ... by making sure that the sampling thread quits before the meters
    are destroyed, and before clearing the low-swap-warning idle
    source.

 app/widgets/gimpdashboard.c |   32 +++++++++++++++++++++-----------
 1 files changed, 21 insertions(+), 11 deletions(-)
---
diff --git a/app/widgets/gimpdashboard.c b/app/widgets/gimpdashboard.c
index 822f971..37793f9 100644
--- a/app/widgets/gimpdashboard.c
+++ b/app/widgets/gimpdashboard.c
@@ -59,6 +59,7 @@
 
 static void       gimp_dashboard_docked_iface_init (GimpDockedInterface *iface);
 
+static void       gimp_dashboard_dispose           (GObject             *object);
 static void       gimp_dashboard_finalize          (GObject             *object);
 
 static void       gimp_dashboard_map               (GtkWidget           *widget);
@@ -99,6 +100,7 @@ gimp_dashboard_class_init (GimpDashboardClass *klass)
   GObjectClass   *object_class = G_OBJECT_CLASS (klass);
   GtkWidgetClass *widget_class = GTK_WIDGET_CLASS (klass);
 
+  object_class->dispose  = gimp_dashboard_dispose;
   object_class->finalize = gimp_dashboard_finalize;
 
   widget_class->map      = gimp_dashboard_map;
@@ -313,10 +315,22 @@ gimp_dashboard_docked_iface_init (GimpDockedInterface *iface)
 }
 
 static void
-gimp_dashboard_finalize (GObject *object)
+gimp_dashboard_dispose (GObject *object)
 {
   GimpDashboard *dashboard = GIMP_DASHBOARD (object);
 
+  if (dashboard->thread)
+    {
+      g_mutex_lock (&dashboard->mutex);
+
+      dashboard->quit = TRUE;
+      g_cond_signal (&dashboard->cond);
+
+      g_mutex_unlock (&dashboard->mutex);
+
+      g_clear_pointer (&dashboard->thread, g_thread_join);
+    }
+
   if (dashboard->timeout_id)
     {
       g_source_remove (dashboard->timeout_id);
@@ -329,17 +343,13 @@ gimp_dashboard_finalize (GObject *object)
       dashboard->low_swap_space_idle_id = 0;
     }
 
-  if (dashboard->thread)
-    {
-      g_mutex_lock (&dashboard->mutex);
-
-      dashboard->quit = TRUE;
-      g_cond_signal (&dashboard->cond);
-
-      g_mutex_unlock (&dashboard->mutex);
+  G_OBJECT_CLASS (parent_class)->dispose (object);
+}
 
-      g_clear_pointer (&dashboard->thread, g_thread_join);
-    }
+static void
+gimp_dashboard_finalize (GObject *object)
+{
+  GimpDashboard *dashboard = GIMP_DASHBOARD (object);
 
   g_mutex_clear (&dashboard->mutex);
   g_cond_clear (&dashboard->cond);


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]