Fix a nasty e-addressbook-factory crasher based on a double-free.

1 files changed, 7 insertions, 4 deletions

diff --git a/addressbook/libedata-book/e-data-book-factory.c b/addressbook/libedata-book/e-data-book-factory.c
index d5e891f83..3bd980498 100644
--- a/addressbook/libedata-book/e-data-book-factory.c
+++ b/addressbook/libedata-book/e-data-book-factory.c
@@ -367,11 +367,14 @@ name_owner_changed (DBusGProxy *proxy,
 		gchar *key;
 		GList *list = NULL;
 		g_mutex_lock (factory->priv->connections_lock);
-		if (g_hash_table_lookup_extended (factory->priv->connections, prev_owner, (gpointer)&key, (gpointer)&list)) {
-			g_list_foreach (list, (GFunc)g_object_unref, NULL);
-			g_list_free (list);
-			g_hash_table_remove (factory->priv->connections, prev_owner);
+		while (g_hash_table_lookup_extended (factory->priv->connections, prev_owner, (gpointer)&key, (gpointer)&list)) {
+			/* this should trigger the book's weak ref notify
+			 * function, which will remove it from the list before
+			 * it's freed, and will remove the connection from
+			 * priv->connections once they're all gone */
+			g_object_unref (list->data);
 		}
+
 		g_mutex_unlock (factory->priv->connections_lock);
 	}
 }