[evolution-data-server] alarm-notify: Double-free with certain types of the reminder



commit 09f81bbebab522ce360c4732851306adf578b89e
Author: Milan Crha <mcrha redhat com>
Date:   Tue Jan 7 11:42:00 2020 +0100

    alarm-notify: Double-free with certain types of the reminder
    
    Specifically 'Audio' and 'Procedure' actions could cause double-free
    with their attachments, due to freeing memory, which belongs to
    the Alarm component (thus the component freed it the second time).
    
    This had been discovered downstream:
    https://bugzilla.redhat.com/show_bug.cgi?id=1754321

 src/services/evolution-alarm-notify/e-alarm-notify.c | 5 -----
 1 file changed, 5 deletions(-)
---
diff --git a/src/services/evolution-alarm-notify/e-alarm-notify.c 
b/src/services/evolution-alarm-notify/e-alarm-notify.c
index 4b4712fda..7ab037f8c 100644
--- a/src/services/evolution-alarm-notify/e-alarm-notify.c
+++ b/src/services/evolution-alarm-notify/e-alarm-notify.c
@@ -140,8 +140,6 @@ e_alarm_notify_audio (EAlarmNotify *an,
        if (!did_play)
                gdk_beep ();
 
-       g_slist_free_full (attachments, g_object_unref);
-
        return FALSE;
 }
 
@@ -457,12 +455,9 @@ e_alarm_notify_procedure (EAlarmNotify *an,
        if (!result)
                goto fallback;
 
-       g_slist_free_full (attachments, g_object_unref);
-
        return FALSE;
 
  fallback:
-       g_slist_free_full (attachments, g_object_unref);
 
        return e_alarm_notify_display (an, rd, alarm);
 }


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]