[glib: 11/19] Fix gvdb_table_write_contents_async()



commit d83587b2a364eb9a9a53be7e6a708074e252de14
Author: Michael Catanzaro <mcatanzaro igalia com>
Date:   Thu Jun 27 16:58:03 2019 -0500

    Fix gvdb_table_write_contents_async()
    
    It worked when I first wrote it, but I broke it during the late stages
    of code review. str is already freed here, so this is a use-after-free
    vulnerability for starters. It also causes the file saved to be always
    empty.

 gvdb-builder.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
---
diff --git a/gvdb-builder.c b/gvdb-builder.c
index cf94691bc..e36e9abbc 100644
--- a/gvdb-builder.c
+++ b/gvdb-builder.c
@@ -608,7 +608,9 @@ gvdb_table_write_contents_async (GHashTable          *table,
   g_task_set_task_data (task, data, (GDestroyNotify)write_contents_data_free);
   g_task_set_source_tag (task, gvdb_table_write_contents_async);
 
-  g_file_replace_contents_async (file, str->str, str->len,
+  g_file_replace_contents_async (file,
+                                 g_bytes_get_data (bytes, NULL),
+                                 g_bytes_get_size (bytes),
                                  NULL, FALSE,
                                  G_FILE_CREATE_PRIVATE | G_FILE_CREATE_REPLACE_DESTINATION,
                                  cancellable, replace_contents_cb, g_steal_pointer (&task));


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]