Hi,

I think that I have found a use-after-free in gnome-nettool (version 3.8.1).

The vuln is located in the fonction get_nic_information (info.c).

The chunk allocated at line 422 :
ip = g_new0 (InfoIpAddr, 1);

is freed during the call to info_ip_addr (call in line 441)
info_ip_addr_free (ip);
 
But he is used at line 481 :
ip->ip_bcast = g_strdup ("");

If the condition (netload.if_flags & (1L << GLIBTOP_IF_FLAGS_LOOPBACK)), line 477 is evaluated to true

The vulnerability was found by my static binary analyzer gueb (that will become open-source soon)
Because I found it with a static analysis, I have not a testcase, but by reading the source code, the path leading the to use-after-free seems not so hard to trigger

Best regards,
Josselin Feist