Package: libgtksourceview-3.0-1
Version: 3.22.2-1
Severity: normal
Tags: patch

--- Please enter the report below this line. ---

The official documentation for the "query-tooltip-markup" and the
"query-tooltip-text" signal, says, that the user should free the
returned string with g_free() when done:
https://developer.gnome.org/gtksourceview/stable/GtkSourceMarkAttributes.html#GtkSourceMarkAttributes-query-tooltip-text

However libgtksourceview as well calls "g_free(text)" on the string,
after evoking the callback-method ( See gtksourcegutterrenderermarks.c,
line 313 )

So whenever the user tries to free the string again, a double-free
seg-fault will happen. Here as well my Stack Overflow question which
describes the problem in detail:
https://stackoverflow.com/questions/42805994/gtksourceview-usage-of-query-tooltip-text

By checking the source-code of libgtksourceview, it looks like the doc
was copy+pasted from the caller-method
"gtk_source_mark_attributes_get_tooltip_text ". For this method the doc
is actually very correct.

Attached a patch to fix the doc for both signals.

Cheers,
Alex

--- System information. ---
Architecture:
Kernel: Linux 4.8.0-2-amd64

Debian Release: 9.0
500 testing www.deb-multimedia.org
500 testing ftp.de.debian.org

--- Package information. ---
Depends (Version) | Installed
=============================================-+-==============
libatk1.0-0 (>= 1.32) | 2.22.0-1
libc6 (>= 2.14) |
libcairo2 (>= 1.4.10) |
libgdk-pixbuf2.0-0 (>= 2.22.0) |
libglib2.0-0 (>= 2.47.1) |
libgtk-3-0 (>= 3.19.12) |
libpango-1.0-0 (>= 1.18.0) |
libpangocairo-1.0-0 (>= 1.14.0) |
libxml2 (>= 2.7.4) |
libgtksourceview-3.0-common (>= 3.22.2-1) |


Package's Recommends field is empty.

Package's Suggests field is empty.
diff --git a/gtksourceview/gtksourcemarkattributes.c b/gtksourceview/gtksourcemarkattributes.c
index 62486d78..7657dade 100644
--- a/gtksourceview/gtksourcemarkattributes.c
+++ b/gtksourceview/gtksourcemarkattributes.c
@@ -316,8 +316,8 @@ gtk_source_mark_attributes_class_init (GtkSourceMarkAttributesClass *klass)
 	 * The code should connect to this signal to provide a tooltip for given
 	 * @mark. The tooltip should be just a plain text.
 	 *
-	 * Returns: (transfer full): A tooltip. The string should be freed with
-	 * g_free() when done with it.
+         * Returns: (transfer full): A tooltip. The returned string has to be allocated
+         * by the signal handler and will be freed by the gtksourceview library.
 	 */
 	signals[QUERY_TOOLTIP_TEXT] =
 		g_signal_new ("query-tooltip-text",
@@ -337,8 +337,8 @@ gtk_source_mark_attributes_class_init (GtkSourceMarkAttributesClass *klass)
 	 * The code should connect to this signal to provide a tooltip for given
 	 * @mark. The tooltip can contain a markup.
 	 *
-	 * Returns: (transfer full): A tooltip. The string should be freed with
-	 * g_free() when done with it.
+         * Returns: (transfer full): A tooltip. The returned string has to be allocated
+         * by the signal handler and will be freed by the gtksourceview library.
 	 */
 	signals[QUERY_TOOLTIP_MARKUP] =
 		g_signal_new ("query-tooltip-markup",

Reply via email to