diff -up GConf-3.2.3/gconf/gconf-dbus.c.use-after-free GConf-3.2.3/gconf/gconf-dbus.c
--- GConf-3.2.3/gconf/gconf-dbus.c.use-after-free	2011-10-26 17:42:49.000000000 +0200
+++ GConf-3.2.3/gconf/gconf-dbus.c	2012-01-04 11:08:08.000000000 +0100
@@ -1244,12 +1244,13 @@ gconf_engine_get_fuller (GConfEngine *co
   
   if (schema_name && schema_name[0] != '/')
     {
+      g_free (schema_name);
       schema_name = NULL;
     }
   
   if (schema_name_p)
-    *schema_name_p = g_strdup (schema_name);
-  
+    *schema_name_p = schema_name;
+
   return val;
 }
 
@@ -2393,7 +2394,7 @@ handle_notify (DBusConnection *connectio
 	       GConfEngine *conf2)
 {
   GConfEngine *conf;
-  gchar *key, *schema_name;
+  gchar *key = NULL, *schema_name = NULL;
   gboolean is_default, is_writable;
   DBusMessageIter iter;
   GConfValue *value;
@@ -2457,6 +2458,8 @@ handle_notify (DBusConnection *connectio
 
   if (value)
     gconf_value_free (value);
+  g_free (key);
+  g_free (schema_name);
 
   if (!match)
     return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
diff -up GConf-3.2.3/gconf/gconf-dbus-utils.c.use-after-free GConf-3.2.3/gconf/gconf-dbus-utils.c
--- GConf-3.2.3/gconf/gconf-dbus-utils.c.use-after-free	2011-07-04 15:33:10.000000000 +0200
+++ GConf-3.2.3/gconf/gconf-dbus-utils.c	2012-01-04 11:06:15.000000000 +0100
@@ -569,11 +569,11 @@ gconf_dbus_utils_get_entry_values (DBusM
 				   gchar           **schema_name_p)
 {
   DBusMessageIter  struct_iter;
-  gchar           *key;
+  const gchar     *key;
   GConfValue      *value;
   gboolean         is_default;
   gboolean         is_writable;
-  gchar           *schema_name;
+  const gchar     *schema_name;
 
   g_return_val_if_fail (dbus_message_iter_get_arg_type (main_iter) == DBUS_TYPE_STRUCT,
 			FALSE);
@@ -587,7 +587,7 @@ gconf_dbus_utils_get_entry_values (DBusM
   value = utils_get_value (&struct_iter);
 
   dbus_message_iter_next (&struct_iter);
-  schema_name = (gchar *) utils_get_optional_string (&struct_iter);
+  schema_name = utils_get_optional_string (&struct_iter);
 
   dbus_message_iter_next (&struct_iter);
   dbus_message_iter_get_basic (&struct_iter, &is_default);
@@ -596,7 +596,7 @@ gconf_dbus_utils_get_entry_values (DBusM
   dbus_message_iter_get_basic (&struct_iter, &is_writable);
 
   if (key_p)
-    *key_p = key;
+    *key_p = g_strdup (key);
 
   if (value_p)
     *value_p = value;
@@ -604,7 +604,7 @@ gconf_dbus_utils_get_entry_values (DBusM
     gconf_value_free (value);
 
   if (schema_name_p)
-    *schema_name_p = schema_name;
+    *schema_name_p = g_strdup (schema_name);
   
   if (is_default_p)
     *is_default_p = is_default;
