[core] Fix race condition when updating authentication details

If a GDataService is destroyed before the set_authentication_details_cb idle
callback is called, it will access freed memory. The authentication process
now keeps a reference to the service until it has finished updating the
service's authentication details.

1 files changed, 4 insertions, 1 deletions

diff --git a/gdata/gdata-service.c b/gdata/gdata-service.c
index dd66abbb..d5cefa59 100644
--- a/gdata/gdata-service.c
+++ b/gdata/gdata-service.c
@@ -414,6 +414,8 @@ authenticate_async_data_free (AuthenticateAsyncData *self)
 {
 	g_free (self->username);
 	g_free (self->password);
+	if (self->service != NULL)
+		g_object_unref (self->service);
 
 	g_slice_free (AuthenticateAsyncData, self);
 }
@@ -470,7 +472,7 @@ authenticate_thread (GSimpleAsyncResult *result, GDataService *service, GCancell
 	}
 
 	/* Update the authentication details held by the service */
-	data->service = service;
+	data->service = g_object_ref (service);
 	g_idle_add ((GSourceFunc) set_authentication_details_cb, data);
 }
 
@@ -505,6 +507,7 @@ gdata_service_authenticate_async (GDataService *self, const gchar *username, con
 	data = g_slice_new (AuthenticateAsyncData);
 	data->username = g_strdup (username);
 	data->password = g_strdup (password);
+	data->service = NULL; /* set in authenticate_thread() */
 
 	result = g_simple_async_result_new (G_OBJECT (self), callback, user_data, gdata_service_authenticate_async);
 	g_simple_async_result_set_op_res_gpointer (result, data, NULL);