GNOME Bugzilla – Bug 570473
gthumb write to freed memory
Last modified: 2009-02-13 18:32:00 UTC
export GNOME_DISABLE_CRASH_DIALOG=1 export LD_PRELOAD=libumem.so export UMEM_DEBUG=audit=50,guards export UMEM_LOGGING=transaction,fail gthumb --veiewer 37902.strip.print.gif select quit a core file is generated.
The root cause is here: In image_loader_finalize__step2(), it calls g_free(priv) to free ImageLoaderPrivateData. But in image_loader_stop__final_step(), after call image_loader_finalize__step2() by idle_call_exec, it still set "priv->interrupted = FALSE;" that's why libumem report error.
Created attachment 127911 [details] [review] patch for this.
Patch committed, thanks! - Mike