diff options
| author | Elliott Sales de Andrade <quantum.analyst@gmail.com> | 2019-01-31 16:46:38 -0500 |
|---|---|---|
| committer | Elliott Sales de Andrade <quantum.analyst@gmail.com> | 2019-02-02 03:00:15 -0500 |
| commit | 7fb2307356184580ab70f0821f45759a13a69be2 (patch) | |
| tree | cd88191af685aa35f7f8e33813853f102bb64092 | |
| parent | 763d054d971e331e06649b33c78b5d5c85a5e224 (diff) | |
| download | gobject-introspection-7fb2307356184580ab70f0821f45759a13a69be2.tar.gz | |
Fix a possible use-after-free.
If g_mapped_file_new fails, then `version` will be freed, but it was
already added to the hash table. This means there could be a
use-after-free while doing a lookup on the hash table the next time.
| -rw-r--r-- | girepository/girepository.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/girepository/girepository.c b/girepository/girepository.c index bc9e4ed5..ca5dc2b9 100644 --- a/girepository/girepository.c +++ b/girepository/girepository.c @@ -1405,7 +1405,6 @@ enumerate_namespace_versions (const gchar *namespace, g_free (version); continue; } - g_hash_table_insert (found_versions, version, version); path = g_build_filename (dirname, entry, NULL); mfile = g_mapped_file_new (path, FALSE, &error); @@ -1422,6 +1421,7 @@ enumerate_namespace_versions (const gchar *namespace, candidate->path = path; candidate->version = version; candidates = g_slist_prepend (candidates, candidate); + g_hash_table_add (found_versions, version); } g_dir_close (dir); index++; |