diff options
author | Milan Crha <mcrha@redhat.com> | 2012-10-18 16:08:02 -0400 |
---|---|---|
committer | Ray Strode <rstrode@redhat.com> | 2012-10-18 16:12:22 -0400 |
commit | 84884e9df7ce8c081a1c223c66a799b82545ff1e (patch) | |
tree | ff113d740ec74eedb21f5780a9927f742a766f52 | |
parent | 44f85b6119149e2c4217b290bae489cf5fb290ad (diff) | |
download | gconf-84884e9df7ce8c081a1c223c66a799b82545ff1e.tar.gz |
gconf-dbus: fix use after free
gconf_engine_get_fuller is accessing freed memory.
The problem is that it's referencing strings that are owned
by a D-Bus message, and they go away when the D-Bus message is freed.
This commit addresses the problem by duplicating the strings and
freeing them later.
https://bugzilla.gnome.org/show_bug.cgi?id=667167
-rw-r--r-- | gconf/gconf-dbus-utils.c | 10 | ||||
-rw-r--r-- | gconf/gconf-dbus.c | 9 |
2 files changed, 11 insertions, 8 deletions
diff --git a/gconf/gconf-dbus-utils.c b/gconf/gconf-dbus-utils.c index 6fd5bfa2..92f59806 100644 --- a/gconf/gconf-dbus-utils.c +++ b/gconf/gconf-dbus-utils.c @@ -569,11 +569,11 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, gchar **schema_name_p) { DBusMessageIter struct_iter; - gchar *key; + const gchar *key; GConfValue *value; gboolean is_default; gboolean is_writable; - gchar *schema_name; + const gchar *schema_name; g_return_val_if_fail (dbus_message_iter_get_arg_type (main_iter) == DBUS_TYPE_STRUCT, FALSE); @@ -587,7 +587,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, value = utils_get_value (&struct_iter); dbus_message_iter_next (&struct_iter); - schema_name = (gchar *) utils_get_optional_string (&struct_iter); + schema_name = utils_get_optional_string (&struct_iter); dbus_message_iter_next (&struct_iter); dbus_message_iter_get_basic (&struct_iter, &is_default); @@ -596,7 +596,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, dbus_message_iter_get_basic (&struct_iter, &is_writable); if (key_p) - *key_p = key; + *key_p = g_strdup (key); if (value_p) *value_p = value; @@ -604,7 +604,7 @@ gconf_dbus_utils_get_entry_values (DBusMessageIter *main_iter, gconf_value_free (value); if (schema_name_p) - *schema_name_p = schema_name; + *schema_name_p = g_strdup (schema_name); if (is_default_p) *is_default_p = is_default; diff --git a/gconf/gconf-dbus.c b/gconf/gconf-dbus.c index f167fc5b..5610fcf4 100644 --- a/gconf/gconf-dbus.c +++ b/gconf/gconf-dbus.c @@ -1252,12 +1252,13 @@ gconf_engine_get_fuller (GConfEngine *conf, if (schema_name && schema_name[0] != '/') { + g_free (schema_name); schema_name = NULL; } if (schema_name_p) - *schema_name_p = g_strdup (schema_name); - + *schema_name_p = schema_name; + return val; } @@ -2402,7 +2403,7 @@ handle_notify (DBusConnection *connection, GConfEngine *conf2) { GConfEngine *conf; - gchar *key, *schema_name; + gchar *key = NULL, *schema_name = NULL; gboolean is_default, is_writable; DBusMessageIter iter; GConfValue *value; @@ -2466,6 +2467,8 @@ handle_notify (DBusConnection *connection, if (value) gconf_value_free (value); + g_free (key); + g_free (schema_name); if (!match) return DBUS_HANDLER_RESULT_NOT_YET_HANDLED; |