diff options
| author | Jiří Klimeš <jklimes@redhat.com> | 2015-12-17 14:31:48 +0100 |
|---|---|---|
| committer | Jiří Klimeš <jklimes@redhat.com> | 2015-12-21 12:36:28 +0100 |
| commit | 597c6880cf4516ac788284d439ed59ff398e57cd (patch) | |
| tree | cae2e4545a93fc53c25d7a9530c390e41da88f06 | |
| parent | 90017ad50ce00e2bc1e4a6fa17e860aecb2742ec (diff) | |
| download | network-manager-applet-597c6880cf4516ac788284d439ed59ff398e57cd.tar.gz | |
applet: fix accessing freed memory (rh #1129818)
It was a problem of looping throught list and invalidating ->next pointer when
removing an item.
See this commit for a similar bug:
http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=b9da3d93207e46de895fd07cfe9de1edfa79efef
(cherry picked from commit 10c78cb60818cb005e105fb71b74e47d93f53688)
| -rw-r--r-- | src/applet.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/applet.c b/src/applet.c index 39ea8e47..7a796223 100644 --- a/src/applet.c +++ b/src/applet.c @@ -3241,11 +3241,13 @@ applet_agent_cancel_secrets_cb (AppletAgent *agent, gpointer user_data) { NMApplet *applet = NM_APPLET (user_data); - GSList *iter; + GSList *iter, *next; - for (iter = applet->secrets_reqs; iter; iter = g_slist_next (iter)) { + for (iter = applet->secrets_reqs; iter; iter = next) { SecretsRequest *req = iter->data; + next = g_slist_next (iter); + if (req->reqid == request_id) { /* cancel and free this password request */ applet_secrets_request_free (req); |