diff options
| author | Stefano Karapetsas <[email protected]> | 2012-09-28 17:51:29 +0300 |
|---|---|---|
| committer | Stefano Karapetsas <[email protected]> | 2012-09-28 17:51:29 +0300 |
| commit | d733605e0b5c4a83deef028454a5fdfa46b322bc (patch) | |
| tree | 45df0cc7fb7ee5af88e91790f09a189e5b7af991 | |
| parent | af012d9af49683a439c110d89a7c4ab0d21f8cca (diff) | |
| download | mate-desktop-d733605e0b5c4a83deef028454a5fdfa46b322bc.tar.bz2 mate-desktop-d733605e0b5c4a83deef028454a5fdfa46b322bc.tar.xz | |
Fix possible double-free when destroying private windows
This could cause free'ing random data when the members of ->windows
were destroyed, but ->windows itself wasn't. As it was != NULL, we'd
be free memory that wouldn't belong to us anymore.
https://bugzilla.gnome.org/show_bug.cgi?id=634534
(patch suggested in MATE by NiceAndGently on https://github.com/mate-desktop/mate-desktop/issues/23)
| -rw-r--r-- | libmate-desktop/mate-rr-labeler.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libmate-desktop/mate-rr-labeler.c b/libmate-desktop/mate-rr-labeler.c index fe9a50c..577a33a 100644 --- a/libmate-desktop/mate-rr-labeler.c +++ b/libmate-desktop/mate-rr-labeler.c @@ -287,11 +287,17 @@ mate_rr_labeler_hide (MateRRLabeler *labeler) g_return_if_fail (MATE_IS_RR_LABELER (labeler)); + if (labeler->windows == NULL) + return; + for (i = 0; i < labeler->num_outputs; i++) if (labeler->windows[i] != NULL) { gtk_widget_destroy (labeler->windows[i]); labeler->windows[i] = NULL; } + g_free (labeler->windows); + labeler->windows = NULL; + } void |