fdo-mirrors/NetworkManager
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/NetworkManager/NetworkManager.git synced 2025-12-31 00:50:12 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

libnm-glib: fix invalid memory access during property notification

Browse source 
If an NMObject listened to property change notifications from
other NMObjects and then in response to that queued up other
property changes of it's own, those would get added to the
property change list that was being iterated through already.
Each name in the change list is freed after being notified,
but the change list itself is actually freed when all
properties have been notified.  So an object that queues up
another change notification ends up in _nm_object_queue_notify()
which iterates the change list where half of the data elements
are already freed...
This commit is contained in:
Dan Williams 2010-06-30 11:51:40 -07:00
parent 932b3cfa5b
commit d2c386a2bc
1 changed files with 12 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
libnm-glib/nm-object.c
View file

@ -47,7 +47,7 @@ typedef struct {
NMObject *parent;
GSList *notify_props;
gulong notify_id;
guint32 notify_id;
gboolean disposed;
} NMObjectPrivate;
@ -255,18 +255,23 @@ deferred_notify_cb (gpointer data)
{
NMObject *object = NM_OBJECT (data);
NMObjectPrivate *priv = NM_OBJECT_GET_PRIVATE (object);
GSList *iter;
GSList *props, *iter;
priv->notify_id = 0;
priv->notify_props = g_slist_reverse (priv->notify_props);
for (iter = priv->notify_props; iter; iter = g_slist_next (iter)) {
/* Clear priv->notify_props early so that an NMObject subclass that
* listens to property changes can queue up other property changes
* during the g_object_notify() call separately from the property
* list we're iterating.
*/
props = g_slist_reverse (priv->notify_props);
priv->notify_props = NULL;
for (iter = props; iter; iter = g_slist_next (iter)) {
g_object_notify (G_OBJECT (object), (const char *) iter->data);
g_free (iter->data);
}
g_slist_free (priv->notify_props);
priv->notify_props = NULL;
g_slist_free (props);
return FALSE;
}