After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 686445 - Use-after-free in panel_object_loader_stop_loading()
Use-after-free in panel_object_loader_stop_loading()
Status: RESOLVED FIXED
Product: gnome-panel
Classification: Other
Component: clock
3.4.x
Other Linux
: Normal normal
: ---
Assigned To: Panel Maintainers
Panel Maintainers
Depends on:
Blocks:
 
 
Reported: 2012-10-19 08:30 UTC by Milan Crha
Modified: 2012-10-26 13:21 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
proposed gp patch (1.38 KB, patch)
2012-10-19 13:10 UTC, Milan Crha
committed Details | Review

Description Milan Crha 2012-10-19 08:30:41 UTC
Extracting this from bug #683406:

Valgrind claims use-after-free in panel_object_loader_stop_loading()

Invalid read of size 1
   at 0x4C2A054: __GI_strcmp (mc_replace_strmem.c:712)
   by 0x45F7D7: panel_object_loader_stop_loading (panel-object-loader.c:125)
   by 0x45FE70: panel_object_loader_idle_handler (panel-object-loader.c:241)
   by 0x7B70204: g_main_context_dispatch (gmain.c:2539)
   by 0x7B70537: g_main_context_iterate.isra.23 (gmain.c:3146)
   by 0x7B70931: g_main_loop_run (gmain.c:3340)
   by 0x5A072D4: gtk_main (gtkmain.c:1161)
   by 0x424E9E: main (main.c:117)
 Address 0x16cf54b0 is 0 bytes inside a block of size 9 free'd
   at 0x4C27D4E: free (vg_replace_malloc.c:427)
   by 0x45F66B: free_object_to_load (panel-object-loader.c:75)
   by 0x45F7B1: panel_object_loader_stop_loading (panel-object-loader.c:120)
   by 0x45FE70: panel_object_loader_idle_handler (panel-object-loader.c:241)
   by 0x7B70204: g_main_context_dispatch (gmain.c:2539)
   by 0x7B70537: g_main_context_iterate.isra.23 (gmain.c:3146)
   by 0x7B70931: g_main_loop_run (gmain.c:3340)
   by 0x5A072D4: gtk_main (gtkmain.c:1161)
   by 0x424E9E: main (main.c:117)
Comment 1 Milan Crha 2012-10-19 13:10:58 UTC
Created attachment 226822 [details] [review]
proposed gp patch

for gnome-panel;

This one is still valid in current master. The 'id' passed into panel_object_loader_stop_loading() can be object->id, but the object is freed within free_object_to_load(), same as 'id', which makes the memory invalid, if freed in the first for in the function.
Comment 2 Vincent Untz 2012-10-26 11:57:32 UTC
Comment on attachment 226822 [details] [review]
proposed gp patch

Good catch, please commit. Just make sure to use spaces and not tabs, though ;-)
Comment 3 Milan Crha 2012-10-26 12:47:30 UTC
(In reply to comment #2)
> (From update of attachment 226822 [details] [review])
> Just make sure to use spaces and not tabs, though

Oops, I didn't notice you do not use tabs there. I'll replace them.
Comment 4 Milan Crha 2012-10-26 13:21:03 UTC
Created commit 686c3cf in gp master (3.6.1+)