|
 |
2ca4f1 |
From 323d0c7658a9a44efc327840c0667044a4b98f89 Mon Sep 17 00:00:00 2001
|
|
|
2ca4f1 |
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
|
|
2ca4f1 |
Date: Mon, 3 Feb 2020 15:38:28 +0200
|
|
|
2ca4f1 |
Subject: [PATCH 2/5] GMainContext - Fix GSource iterator if iteration can
|
|
|
2ca4f1 |
modify the list
|
|
|
2ca4f1 |
|
|
|
2ca4f1 |
We first have to ref the next source and then unref the previous one.
|
|
|
2ca4f1 |
This might be the last reference to the previous source, and freeing the
|
|
|
2ca4f1 |
previous source might unref and free the next one which would then leave
|
|
|
2ca4f1 |
use with a dangling pointer here.
|
|
|
2ca4f1 |
|
|
|
2ca4f1 |
Fixes https://gitlab.gnome.org/GNOME/glib/issues/2031
|
|
|
2ca4f1 |
---
|
|
|
2ca4f1 |
glib/gmain.c | 8 ++++++--
|
|
|
2ca4f1 |
1 file changed, 6 insertions(+), 2 deletions(-)
|
|
|
2ca4f1 |
|
|
|
2ca4f1 |
diff --git a/glib/gmain.c b/glib/gmain.c
|
|
|
2ca4f1 |
index 5b91c3117..a3ea1d36c 100644
|
|
|
2ca4f1 |
--- a/glib/gmain.c
|
|
|
2ca4f1 |
+++ b/glib/gmain.c
|
|
|
2ca4f1 |
@@ -965,13 +965,17 @@ g_source_iter_next (GSourceIter *iter, GSource **source)
|
|
|
2ca4f1 |
* GSourceList to be removed from source_lists (if iter->source is
|
|
|
2ca4f1 |
* the only source in its list, and it is destroyed), so we have to
|
|
|
2ca4f1 |
* keep it reffed until after we advance iter->current_list, above.
|
|
|
2ca4f1 |
+ *
|
|
|
2ca4f1 |
+ * Also we first have to ref the next source before unreffing the
|
|
|
2ca4f1 |
+ * previous one as unreffing the previous source can potentially
|
|
|
2ca4f1 |
+ * free the next one.
|
|
|
2ca4f1 |
*/
|
|
|
2ca4f1 |
+ if (next_source && iter->may_modify)
|
|
|
2ca4f1 |
+ g_source_ref (next_source);
|
|
|
2ca4f1 |
|
|
|
2ca4f1 |
if (iter->source && iter->may_modify)
|
|
|
2ca4f1 |
g_source_unref_internal (iter->source, iter->context, TRUE);
|
|
|
2ca4f1 |
iter->source = next_source;
|
|
|
2ca4f1 |
- if (iter->source && iter->may_modify)
|
|
|
2ca4f1 |
- g_source_ref (iter->source);
|
|
|
2ca4f1 |
|
|
|
2ca4f1 |
*source = iter->source;
|
|
|
2ca4f1 |
return *source != NULL;
|
|
|
2ca4f1 |
--
|
|
|
2ca4f1 |
2.31.1
|
|
|
2ca4f1 |
|