diff options
| author | Michael Mestnik <[email protected]> | 2026-05-19 07:57:50 -0400 |
|---|---|---|
| committer | Victor Kareh <[email protected]> | 2026-05-20 07:33:38 -0400 |
| commit | f5a03c479c5389ad267fa94faeaa02f8acbbcae1 (patch) | |
| tree | 846ace5fa754c1c3630d4e833289a6621e03ab73 | |
| parent | 414d0f6d92aba6dedbe9d2ee1f5e1e3a78e9d355 (diff) | |
| download | mate-panel-fix-use-after-free-bg-operation.tar.bz2 mate-panel-fix-use-after-free-bg-operation.tar.xz | |
panel-applet-frame-dbus: fix crash when applet is removed during background updatefix-use-after-free-bg-operation
Cancel any pending background operation when the applet frame is
destroyed, and avoid accessing the frame in the callback if the
operation was cancelled or failed.
Fixes #1557
| -rw-r--r-- | mate-panel/libmate-panel-applet-private/panel-applet-frame-dbus.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/mate-panel/libmate-panel-applet-private/panel-applet-frame-dbus.c b/mate-panel/libmate-panel-applet-private/panel-applet-frame-dbus.c index a11d43f4..3ef72b1d 100644 --- a/mate-panel/libmate-panel-applet-private/panel-applet-frame-dbus.c +++ b/mate-panel/libmate-panel-applet-private/panel-applet-frame-dbus.c @@ -231,8 +231,14 @@ container_child_background_set (GObject *source_object, { MatePanelAppletContainer *container = MATE_PANEL_APPLET_CONTAINER (source_object); MatePanelAppletFrameDBus *frame = MATE_PANEL_APPLET_FRAME_DBUS (user_data); + GError *error = NULL; + + mate_panel_applet_container_child_set_finish (container, res, &error); - mate_panel_applet_container_child_set_finish (container, res, NULL); + if (error) { + g_error_free (error); + return; + } frame->priv->bg_operation = NULL; } @@ -327,6 +333,8 @@ mate_panel_applet_frame_dbus_finalize (GObject *object) { MatePanelAppletFrameDBus *frame = MATE_PANEL_APPLET_FRAME_DBUS (object); + if (frame->priv->bg_operation) + mate_panel_applet_container_cancel_operation (frame->priv->container, frame->priv->bg_operation); frame->priv->bg_operation = NULL; G_OBJECT_CLASS (mate_panel_applet_frame_dbus_parent_class)->finalize (object); |