http://bugzilla.moblin.org/show_bug.cgi?id=4919
Summary: GTK-UI: memory use-after-free when server cannot be
started
Classification: Moblin Projects
Product: SyncEvolution
Version: upstream
Platform: Netbook
OS/Version: Moblin Linux
Status: ASSIGNED
Severity: normal
Priority: P2
Component: * Feature Request
AssignedTo: [email protected]
ReportedBy: [email protected]
CC: [email protected]
If the syncevo-dbus-server cannot be started, then sync-ui runs into a
use-after-free error and may crash.
The chain of events is like this:
* syncevo_service_get_server_config_async(): create data
* get_server_config_async_error(): called, frees data
* get_server_config_async_error(): called again with same data pointer, now
invalid
Here's the valgrind report (only appears when running with
G_SLICE=always-malloc G_DEBUG=gc-friendly):
==18845== Invalid read of size 8
==18845== at 0x411F4B: get_server_config_async_error (syncevo-dbus.c:664)
==18845== by 0x66A5209: g_main_context_dispatch (gmain.c:1814)
==18845== by 0x66A88DF: g_main_context_iterate (gmain.c:2448)
==18845== by 0x66A8DAC: g_main_loop_run (gmain.c:2656)
==18845== by 0x4F61BC6: gtk_main (gtkmain.c:1205)
==18845== by 0x405E8E: main (main.c:113)
==18845== Address 0xde31a40 is 8 bytes inside a block of size 24 free'd
==18845== at 0x4C265AF: free (vg_replace_malloc.c:323)
==18845== by 0x411F7A: get_server_config_async_error (syncevo-dbus.c:668)
==18845== by 0x66A5209: g_main_context_dispatch (gmain.c:1814)
==18845== by 0x66A88DF: g_main_context_iterate (gmain.c:2448)
==18845== by 0x66A8DAC: g_main_loop_run (gmain.c:2656)
==18845== by 0x4F61BC6: gtk_main (gtkmain.c:1205)
==18845== by 0x405E8E: main (main.c:113)
{
<insert a suppression name here>
Memcheck:Addr8
fun:get_server_config_async_error
fun:g_main_context_dispatch
fun:g_main_context_iterate
....
I'm not sure what the right memory handling for data is. As a workaround I have
removed the g_slice_delete(). Better leak some memory instead of crashing...
Jussi, please check this.
--
Configure bugmail: http://bugzilla.moblin.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching someone on the CC list of the bug.
_______________________________________________
Syncevolution-issues mailing list
[email protected]
http://lists.syncevolution.org/listinfo/syncevolution-issues
