After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 651068 - [PATCH] fix crash during incremental search
[PATCH] fix crash during incremental search
Status: RESOLVED FIXED
Product: gedit
Classification: Applications
Component: general
3.0.x
Other Linux
: Normal normal
: ---
Assigned To: Gedit maintainers
Gedit maintainers
: 651036 651578 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2011-05-25 14:41 UTC by Dan Williams
Modified: 2011-05-31 21:20 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
prevent use-after-free during incremental search (565 bytes, patch)
2011-05-25 14:41 UTC, Dan Williams 		needs-work Details | Review
prevent use-after-free during incremental search (923 bytes, patch)
2011-05-25 14:52 UTC, Dan Williams 		none Details | Review

Description Dan Williams 2011-05-25 14:41:22 UTC 
I've been getting this for a while and after running valgrind on gedit it pointed to a double-free in init_search_entry(), at gedit-view-frame.c:1248 in gedit 3.0.2.  Looks like there's one case where frame->priv->old_search_text might get re-assigned, but I can't find out where it gets NULLed out when it's not re-assigned.  Thus it could get re-used later on.
Comment 1 Dan Williams 2011-05-25 14:41:59 UTC 
Created attachment 188597 [details] [review]
prevent use-after-free during incremental search
Comment 2 Dan Williams 2011-05-25 14:46:44 UTC 
Bug 651036 might be a dupe.
Comment 3 Ignacio Casal Quinteiro (nacho) 2011-05-25 14:49:49 UTC 
Review of attachment 188597 [details] [review]:

Thanks for pointing this out. See the comment and feel free to push it.

::: gedit-3.0.2/gedit/gedit-view-frame.c.foo
@@ +1248,2 @@
 		g_free (frame->priv->old_search_text);
+		frame->priv->old_search_text = NULL;

yeah, my fault, see that we assign the new value in an if. So let's move the free to the point where we are assigning it.

else if (old_find_text != NULL)
{
  g_free (frame->priv->old_search_text);
  ....
}
Comment 4 Dan Williams 2011-05-25 14:52:46 UTC 
Created attachment 188598 [details] [review]
prevent use-after-free during incremental search
Comment 5 Dan Williams 2011-05-25 14:53:17 UTC 
Ok, I'll make that change and push, thanks.
Comment 6 Dan Williams 2011-05-25 15:07:32 UTC 
f8508ca201e7d16fa5e18a6130f456fdd3fc0c99
Comment 7 Dan Williams 2011-05-25 15:07:45 UTC 
*** Bug 651036 has been marked as a duplicate of this bug. ***
Comment 8 Ignacio Casal Quinteiro (nacho) 2011-05-31 21:20:15 UTC 
*** Bug 651578 has been marked as a duplicate of this bug. ***