GNOME Bugzilla – Bug 672374
Fix memory corruption in meta_later_remove
Last modified: 2012-03-19 06:05:20 UTC
Downstream there's a number of people seeing crashers that look to be heap corruption. One user experiencing the problem ran his session in valgrind and noticed a problem. See https://bugzilla.redhat.com/show_bug.cgi?id=802903
Created attachment 210070 [details] [review] util: Fix memory corruption in meta_later_remove commit 7f9472a58fe9605a63c0da37abe29f3c07ad54a9 plugged a memory leak in meta_later_remove that was caused by the list node associated with the later object never getting freed. It introduced memory corruption, though, since the for loop immediately accesses the now freed node to find the next node in the list. This commit changes the for loop to a while loop and looks up the next node before freeing the current node. Spotted from valgrind log on downstream report: https://bugzilla.redhat.com/show_bug.cgi?id=802903 ==6045== Invalid read of size 8 ==6045== at 0x334C466190: meta_later_remove (util.c:914) ==6045== by 0x334C466316: call_idle_later (util.c:834) ==6045== by 0x3169444ACC: g_main_context_dispatch (gmain.c:2441) ==6045== by 0x31694452C7: g_main_context_iterate (gmain.c:3089) ==6045== by 0x3169445814: g_main_loop_run (gmain.c:3297) ==6045== by 0x334C456AB0: meta_run (main.c:555) ==6045== by 0x4029E0: main (main.c:571) ==6045== Address 0x284d3d08 is 8 bytes inside a block of size 16 free'd ==6045== at 0x4A0662E: free (vg_replace_malloc.c:366) ==6045== by 0x316944B7E2: g_free (gmem.c:263) ==6045== by 0x31694606BE: g_slice_free1 (gslice.c:907) ==6045== by 0x3169461399: g_slist_delete_link (gslist.c:583) ==6045== by 0x334C466148: meta_later_remove (util.c:919) ==6045== by 0x334C466316: call_idle_later (util.c:834) ==6045== by 0x3169444ACC: g_main_context_dispatch (gmain.c:2441) ==6045== by 0x31694452C7: g_main_context_iterate (gmain.c:3089) ==6045== by 0x3169445814: g_main_loop_run (gmain.c:3297) ==6045== by 0x334C456AB0: meta_run (main.c:555) ==6045== by 0x4029E0: main (main.c:571)
Created attachment 210073 [details] [review] util: Quit early once we've found and removed a later This prevents an invalid read and also improves performance slightly. Alternate solution.
Review of attachment 210073 [details] [review]: yours is better.
Comment on attachment 210073 [details] [review] util: Quit early once we've found and removed a later Attachment 210073 [details] pushed as 5770b5b - util: Quit early once we've found and removed a later