After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 641176 - Fix crash in gtk_fixed_remove()
Fix crash in gtk_fixed_remove()
Status: RESOLVED FIXED
Product: gtk+
Classification: Platform
Component: Widget: Other
unspecified
Other All
: Normal normal
: ---
Assigned To: gtk-bugs
gtk-bugs
Depends on:
Blocks:
 
 
Reported: 2011-02-01 19:04 UTC by Vincent Untz
Modified: 2011-02-01 19:09 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Fix crash in gtk_fixed_remove() (736 bytes, patch)
2011-02-01 19:04 UTC, Vincent Untz 		committed Details | Review

Description Vincent Untz 2011-02-01 19:04:04 UTC 
"children = children->next" is called twice in the loop, which means we can go past the end.
Comment 1 Vincent Untz 2011-02-01 19:04:06 UTC 
Created attachment 179821 [details] [review]
Fix crash in gtk_fixed_remove()

b3f6f67c changed the loop from while() to for(), but the line to move to
the next child was kept, so we could go past the end of the list.
Comment 2 Vincent Untz 2011-02-01 19:09:27 UTC 
This problem has been fixed in the development version. The fix will be available in the next major software release. Thank you for your bug report.