Attachment 46289 Details for Bug 36793 – [4/6] dbus_g_connection_unregister_g_object: fix out-of-bounds reading

[patch] [4/6] dbus_g_connection_unregister_g_object: fix out-of-bounds reading

0004-dbus_g_connection_unregister_g_object-fix-out-of-bou.patch (text/plain), 1.48 KB, created by Simon McVittie on 2011-05-03 08:09:57 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2011-05-03 08:09:57 UTC

Size: 1.48 KB

patch

obsolete

>From f8cecd5058a09d94aaa669168d124882b396dcea Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Tue, 3 May 2011 11:59:44 +0100
>Subject: [PATCH 4/6] dbus_g_connection_unregister_g_object: fix out-of-bounds
> reading
>
>The list of registrations is singly linked; we only avoid a crash here
>by luck.
>
>Bug: https://bugs.freedesktop.org/show_bug.cgi?id=36793
>---
> dbus/dbus-gobject.c |    6 +++---
> 1 files changed, 3 insertions(+), 3 deletions(-)
>
>diff --git a/dbus/dbus-gobject.c b/dbus/dbus-gobject.c
>index bddcd1b..f130bb6 100644
>--- a/dbus/dbus-gobject.c
>+++ b/dbus/dbus-gobject.c
>@@ -2498,12 +2498,12 @@ void
> dbus_g_connection_unregister_g_object (DBusGConnection *connection,
>                                        GObject *object)
> {
>-  GList *registrations, *iter;
>+  GSList *registrations, *iter;
> 
>   /* Copy the list before iterating it: it will be modified in
>    * object_registration_free() each time an object path is unregistered.
>    */
>-  registrations = g_list_copy (g_object_get_data (object, "dbus_glib_object_registrations"));
>+  registrations = g_slist_copy (g_object_get_data (object, "dbus_glib_object_registrations"));
> 
>   g_return_if_fail (registrations != NULL);
> 
>@@ -2514,7 +2514,7 @@ dbus_g_connection_unregister_g_object (DBusGConnection *connection,
>           o->object_path);
>     }
> 
>-  g_list_free (registrations);
>+  g_slist_free (registrations);
>   g_assert (g_object_get_data (object, "dbus_glib_object_registrations") == NULL);
> }
> 
>-- 
>1.7.4.4
>

Actions: View | Splinter Review

Attachments on bug 36793: 46286 | 46287 | 46288 | 46289 | 46290 | 46291 | 46314 | 46315

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.