Blob Blame History Raw
diff -up evolution-data-server-3.22.7/calendar/libecal/e-cal-component.c.use-after-free-component-summary-set evolution-data-server-3.22.7/calendar/libecal/e-cal-component.c
--- evolution-data-server-3.22.7/calendar/libecal/e-cal-component.c.use-after-free-component-summary-set	2017-03-20 10:07:46.000000000 +0100
+++ evolution-data-server-3.22.7/calendar/libecal/e-cal-component.c	2017-04-12 12:37:17.319310071 +0200
@@ -4468,7 +4468,7 @@ e_cal_component_get_summary (ECalCompone
 }
 
 typedef struct {
-	const gchar *old_summary;
+	gchar *old_summary;
 	const gchar *new_summary;
 } SetAlarmDescriptionData;
 
@@ -4559,7 +4559,8 @@ e_cal_component_set_summary (ECalCompone
 	g_return_if_fail (summary->value != NULL);
 
 	if (priv->summary.prop) {
-		sadd.old_summary = icalproperty_get_summary (priv->summary.prop);
+		/* Make a copy, to avoid use-after-free */
+		sadd.old_summary = g_strdup (icalproperty_get_summary (priv->summary.prop));
 		icalproperty_set_summary (priv->summary.prop, (gchar *) summary->value);
 	} else {
 		sadd.old_summary = NULL;
@@ -4589,6 +4590,8 @@ e_cal_component_set_summary (ECalCompone
 	/* look for alarms that need a description */
 	sadd.new_summary = summary->value;
 	g_hash_table_foreach (priv->alarm_uid_hash, set_alarm_description_cb, &sadd);
+
+	g_free (sadd.old_summary);
 }
 
 /**