GNOME Bugzilla – Bug 726492
Possible crash when setting titlebar
Last modified: 2014-03-17 14:34:11 UTC
Created attachment 272119 [details] test.c valgrind output of the test application ==13626== Invalid read of size 8 ==13626== at 0x6290000: g_type_check_instance_cast (gtype.c:3997) ==13626== by 0x4F77326: update_title (gtkdialog.c:282) ==13626== by 0x626D477: g_closure_invoke (gclosure.c:768) ==13626== by 0x627F83C: signal_emit_unlocked_R (gsignal.c:3551) ==13626== by 0x62877E2: g_signal_emit_valist (gsignal.c:3307) ==13626== by 0x6287A21: g_signal_emit (gsignal.c:3363) ==13626== by 0x6271824: g_object_dispatch_properties_changed (gobject.c:1053) ==13626== by 0x6273FDA: g_object_notify (gobject.c:1147) ==13626== by 0x515CDA6: gtk_window_set_titlebar (gtkwindow.c:3666) ==13626== by 0x400A15: main (in /tmp/test) ==13626== Address 0x130b0440 is 320 bytes inside a block of size 376 free'd ==13626== at 0x4C28C47: free (vg_replace_malloc.c:469) ==13626== by 0x64FD43E: g_free (gmem.c:190) ==13626== by 0x65134A8: g_slice_free1 (gslice.c:1112) ==13626== by 0x628EE13: g_type_free_instance (gtype.c:1932) ==13626== by 0x4F09894: gtk_box_forall (gtkbox.c:2545) ==13626== by 0x4F541F0: gtk_container_destroy (gtkcontainer.c:1410) ==13626== by 0x626D477: g_closure_invoke (gclosure.c:768) ==13626== by 0x627FBD3: signal_emit_unlocked_R (gsignal.c:3667) ==13626== by 0x62877E2: g_signal_emit_valist (gsignal.c:3307) ==13626== by 0x6287A21: g_signal_emit (gsignal.c:3363) ==13626== by 0x514D747: gtk_widget_dispose (gtkwidget.c:11348) ==13626== by 0x6271DB7: g_object_unref (gobject.c:3075) ==13626== by 0x5151E91: gtk_widget_unparent (gtkwidget.c:4297) ==13626== by 0x5155854: unset_titlebar (gtkwindow.c:3593) ==13626== by 0x515CCC2: gtk_window_set_titlebar (gtkwindow.c:3707) ==13626== by 0x400A15: main (in /tmp/test)
Created attachment 272120 [details] [review] dialog: Avoid possible use-after-free When the dialogue's titlebar was replaced, we were still trying to update the label we constructed but that was now destroyed.
Review of attachment 272120 [details] [review]: ok
Attachment 272120 [details] pushed as 20c764f - dialog: Avoid possible use-after-free