diff options
| author | Thomas Haller <thaller@redhat.com> | 2014-04-09 14:05:08 +0200 |
|---|---|---|
| committer | Thomas Haller <thaller@redhat.com> | 2014-04-09 15:14:05 +0200 |
| commit | 58500b3b8bf8f06b04f1d349daa1cae4e46915b8 (patch) | |
| tree | 2c3ba6f44a21bdc99c9d96cf2c19e429ac796ef1 | |
| parent | 3c211760c564233571da6381caa7f727b79bab14 (diff) | |
| download | NetworkManager-58500b3b8bf8f06b04f1d349daa1cae4e46915b8.tar.gz | |
core: fix freeing pending activations in dispose() of device
activate_data_free() deletes the data from priv->pending_activation_checks,
thus iterating over the list with g_slist_free_full() causes a double
free or invalid memory access.
This bug does not hit easily, because the policy only get's disposed
when NM shuts down and then there are likely no pending activations
queued.
Fixes regression introduced by commit 4f0c70e94534abafde6a0459af74b68a7da724d9.
Signed-off-by: Thomas Haller <thaller@redhat.com>
| -rw-r--r-- | src/nm-policy.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/nm-policy.c b/src/nm-policy.c index f569b75360..f454d90fbf 100644 --- a/src/nm-policy.c +++ b/src/nm-policy.c @@ -2165,8 +2165,8 @@ dispose (GObject *object) g_clear_object (&priv->lookup_addr); g_clear_object (&priv->resolver); - g_slist_free_full (priv->pending_activation_checks, (GDestroyNotify) activate_data_free); - priv->pending_activation_checks = NULL; + while (priv->pending_activation_checks) + activate_data_free (priv->pending_activation_checks->data); g_slist_free_full (priv->pending_secondaries, (GDestroyNotify) pending_secondary_data_free); priv->pending_secondaries = NULL; |