After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 719563 - input-device: Guard against double free
input-device: Guard against double free
Status: RESOLVED FIXED
Product: clutter
Classification: Platform
Component: general
unspecified
Other All
: Normal normal
: ---
Assigned To: clutter-maint
clutter-maint
: 719664 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2013-11-29 15:51 UTC by Florian Müllner
Modified: 2013-12-02 14:43 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
input-device: Guard against double free (1011 bytes, patch)
2013-11-29 15:56 UTC, Florian Müllner
committed Details | Review

Description Florian Müllner 2013-11-29 15:51:14 UTC
See patch.
Comment 1 Florian Müllner 2013-11-29 15:56:49 UTC
Created attachment 263133 [details] [review]
input-device: Guard against double free

Dispose() may be called more than once, so calling g_free directly
on the device name is unsafe. Instead, use g_clear_pointer() to
make sure we don't attempt to free the memory again.
Comment 2 Emmanuele Bassi (:ebassi) 2013-12-01 22:28:19 UTC
*** Bug 719664 has been marked as a duplicate of this bug. ***
Comment 3 Emmanuele Bassi (:ebassi) 2013-12-01 22:29:06 UTC
Review of attachment 263133 [details] [review]:

okay. please, push to the clutter-1.18 and clutter-1.16 branches.
Comment 4 Florian Müllner 2013-12-01 23:30:50 UTC
Attachment 263133 [details] pushed as f9e8c21 - input-device: Guard against double free
Comment 5 Jasper St. Pierre (not reading bugmail) 2013-12-02 06:02:26 UTC
I managed to get a crash that pointed here, but it was caused by the recent cogl commits causing Clutter to call an unknown method and corrupted memory.

Have you got this legitimately? How did the input devices get disposed twice?
Comment 6 Florian Müllner 2013-12-02 08:35:31 UTC
(In reply to comment #5)
> How did the input devices get disposed twice?

I didn't check that, but dispose being called multiple times is legitimate and documented behavior[0]. And yes, "my" crash was actually caused by this - glibc complaining about double-free and the stacktrace pointing to this code. Oh, and the patch fixing it of course :-)

[0] https://git.gnome.org/browse/glib/tree/gobject/gobject.h#n266
Comment 7 Jasper St. Pierre (not reading bugmail) 2013-12-02 14:43:02 UTC
Yes, dispose can be called multiple times, but that doesn't mean it will always happen at object destruction time. Looking through the code, I can't figure out any way that a double-dispose will happen. I saw this glibc double-free error, but when I investigated, it was memory corruption caused by undefined symbols from cogl.

I still don't know what's up with those undefined symbols btw -- I just reverted the top patch on cogl-1.18 locally, and it fixed it.