*** Plucked rev 3976bac9dc1aafa42217dda56118316cb2fed956 (8e1d807c1aadfb510e14f047d2cf00e0c06be465):

If a buddy is deleted less than 11 seconds after they sign on or off, and
there is a conversation open with that buddy, the PurpleBuddy will be
dereferenced after it has been freed. This avoids that by duplicating the
required details from the PurpleBuddy for use in the status_timeout callback.

1 files changed, 16 insertions, 3 deletions

diff --git a/pidgin/gtkconv.c b/pidgin/gtkconv.c
index 13626e8bda..9d2b473f01 100644
--- a/pidgin/gtkconv.c
+++ b/pidgin/gtkconv.c
@@ -7622,16 +7622,24 @@ account_signing_off(PurpleConnection *gc)
 	}
 }
 
+struct _status_timeout_user {
+	gchar *name;
+	PurpleAccount *account;
+};
+
 static gboolean
-update_buddy_status_timeout(PurpleBuddy *buddy)
+update_buddy_status_timeout(struct _status_timeout_user *user)
 {
 	/* To remove the signing-on/off door icon */
 	PurpleConversation *conv;
 
-	conv = purple_find_conversation_with_account(PURPLE_CONV_TYPE_IM, buddy->name, buddy->account);
+	conv = purple_find_conversation_with_account(PURPLE_CONV_TYPE_IM, user->name, user->account);
 	if (conv)
 		pidgin_conv_update_fields(conv, PIDGIN_CONV_TAB_ICON);
 
+	g_free(user->name);
+	g_free(user);
+
 	return FALSE;
 }
 
@@ -7640,6 +7648,7 @@ update_buddy_status_changed(PurpleBuddy *buddy, PurpleStatus *old, PurpleStatus
 {
 	PidginConversation *gtkconv;
 	PurpleConversation *conv;
+	struct _status_timeout_user *user;
 
 	gtkconv = get_gtkconv_with_contact(purple_buddy_get_contact(buddy));
 	if (gtkconv)
@@ -7652,8 +7661,12 @@ update_buddy_status_changed(PurpleBuddy *buddy, PurpleStatus *old, PurpleStatus
 			pidgin_conv_update_fields(conv, PIDGIN_CONV_MENU);
 	}
 
+	user = g_malloc(sizeof(struct _status_timeout_user));
+	user->name = g_strdup(buddy->name);
+	user->account = buddy->account;
+
 	/* In case a conversation is started after the buddy has signed-on/off */
-	purple_timeout_add_seconds(11, (GSourceFunc)update_buddy_status_timeout, buddy);
+	purple_timeout_add_seconds(11, (GSourceFunc)update_buddy_status_timeout, user);
 }
 
 static void