[eog] EogImage: Properly stop animation tick when disposing an animation

[Felix Riemann <friemann src gnome org>]

commit cda957f6efdab8494e66ec37dc272e1f67102327
Author: Felix Riemann <friemann gnome org>
Date:   Thu May 20 21:39:05 2021 +0200

    EogImage: Properly stop animation tick when disposing an animation
    
    Avoids a use-after-free if the tick triggers after _dispose has run.
    
    Fixes #195.

 src/eog-image-private.h |  2 ++
 src/eog-image.c         | 19 +++++++++++++++----
 2 files changed, 17 insertions(+), 4 deletions(-)
---
diff --git a/src/eog-image-private.h b/src/eog-image-private.h
index e0c15923..aa3402b3 100644
--- a/src/eog-image-private.h
+++ b/src/eog-image-private.h
@@ -71,6 +71,8 @@ struct _EogImagePrivate {
 
        gboolean          autorotate;
        gint              orientation;
+
+       guint             anim_source;
 #ifdef HAVE_EXIF
        ExifData         *exif;
 #endif
diff --git a/src/eog-image.c b/src/eog-image.c
index 8cd88cc2..6075dad2 100644
--- a/src/eog-image.c
+++ b/src/eog-image.c
@@ -101,6 +101,11 @@ eog_image_free_mem_private (EogImage *image)
        if (priv->status == EOG_IMAGE_STATUS_LOADING) {
                eog_image_cancel_load (image);
        } else {
+               if (priv->anim_source != 0) {
+                       g_source_remove (priv->anim_source);
+                       priv->anim_source = 0;
+               }
+
                if (priv->anim_iter != NULL) {
                        g_object_unref (priv->anim_iter);
                        priv->anim_iter = NULL;
@@ -315,6 +320,7 @@ eog_image_init (EogImage *img)
        img->priv->trans = NULL;
        img->priv->trans_autorotate = NULL;
        img->priv->data_ref_count = 0;
+       img->priv->anim_source = 0;
 #ifdef HAVE_EXIF
        img->priv->orientation = 0;
        img->priv->autorotate = FALSE;
@@ -2426,10 +2432,13 @@ private_timeout (gpointer data)
            !g_source_is_destroyed (g_main_current_source ()) &&
            priv->is_playing) {
                while (eog_image_iter_advance (img) != TRUE) {}; /* cpu-sucking ? */
-                       g_timeout_add (gdk_pixbuf_animation_iter_get_delay_time (priv->anim_iter), 
private_timeout, img);
-                       return FALSE;
-       }
+               priv->anim_source = g_timeout_add (
+                       gdk_pixbuf_animation_iter_get_delay_time (priv->anim_iter),
+                       private_timeout, img);
+               return FALSE;
+       }
        priv->is_playing = FALSE;
+       priv->anim_source = 0;
        return FALSE; /* stop playing */
 }
 
@@ -2457,7 +2466,9 @@ eog_image_start_animation (EogImage *img)
        priv->is_playing = TRUE;
        g_mutex_unlock (&priv->status_mutex);
 
-       g_timeout_add (gdk_pixbuf_animation_iter_get_delay_time (priv->anim_iter), private_timeout, img);
+       priv->anim_source =
+               g_timeout_add (gdk_pixbuf_animation_iter_get_delay_time (priv->anim_iter),
+                              private_timeout, img);
 
        return TRUE;
 }