diff options
| author | Matthias Clasen <mclasen@redhat.com> | 2009-04-28 19:57:32 -0400 |
|---|---|---|
| committer | Matthias Clasen <mclasen@redhat.com> | 2009-04-28 19:57:32 -0400 |
| commit | 51443645f2e394c1f138fd285fbbe56962d34779 (patch) | |
| tree | 10bd53cfbbb60ebf215c305638436202e5c32ff3 /daemon | |
| parent | 758666242f97ff02c826ee37f2965ac5a828402d (diff) | |
| download | gdm-51443645f2e394c1f138fd285fbbe56962d34779.tar.gz | |
Fix an obvious use-after-free in the XDMCP code
The patch was provided by Michael Young in rhbz#496882.
Diffstat (limited to 'daemon')
| -rw-r--r-- | daemon/gdm-xdmcp-display-factory.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/daemon/gdm-xdmcp-display-factory.c b/daemon/gdm-xdmcp-display-factory.c index 724717ce..1d33b448 100644 --- a/daemon/gdm-xdmcp-display-factory.c +++ b/daemon/gdm-xdmcp-display-factory.c @@ -2309,8 +2309,6 @@ gdm_xdmcp_handle_request (GdmXdmcpDisplayFactory *factory, authorization_data.data = (CARD8 *) cookie->data; authorization_data.length = cookie->len; - g_array_free (cookie, TRUE); - /* the addrs are NOT copied */ gdm_xdmcp_send_accept (factory, address, @@ -2319,6 +2317,8 @@ gdm_xdmcp_handle_request (GdmXdmcpDisplayFactory *factory, &authentication_data, &authorization_name, &authorization_data); + + g_array_free (cookie, TRUE); } } } else { |