Backport patch to fix possible invalid pointer in dbus callback
... in the FD.o notification backend https://bugzilla.redhat.com/show_bug.cgi?id=1584916 https://gitlab.gnome.org/GNOME/glib/merge_requests/90 https://gitlab.gnome.org/GNOME/glib/merge_requests/102
This commit is contained in:
Debarshi Ray
parent
6c43ffbb6e
commit
9c3ca0aa8b
136
glib2-gfdonotificationbackend-fix-possible-invalid-pointer.patch
Normal file
136
glib2-gfdonotificationbackend-fix-possible-invalid-pointer.patch
Normal file
@ -0,0 +1,136 @@
|
|||||||
|
From d26b66e225d3f0d308b2ec1a862a505709076bf7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Arnaud Rebillout <elboulangero@gmail.com>
|
||||||
|
Date: Sun, 10 Jun 2018 20:56:12 +0700
|
||||||
|
Subject: [PATCH] gfdonotificationbackend: Fix possible invalid pointer in dbus
|
||||||
|
callback
|
||||||
|
|
||||||
|
The way things were before: a FreedesktopNotification struct is
|
||||||
|
allocated before the dbus call, and this same struct is possibly re-used
|
||||||
|
for other dbus calls. If the server becomes unavailable, the callback
|
||||||
|
will be invoked after the call times out, which leaves a long time where
|
||||||
|
other dbus calls can happen, re-using the same FreedesktopNotification
|
||||||
|
as user data. When the first call times out, the callback is invoked,
|
||||||
|
and the user data is freed. Subsequent calls that used the same user
|
||||||
|
data will time out later on, and try to free a pointer that was already
|
||||||
|
freed, hence segfaults.
|
||||||
|
|
||||||
|
This bug can be reproduced in Cinnamon 3.6.7, as mentioned in:
|
||||||
|
<https://github.com/linuxmint/Cinnamon/issues/7491>
|
||||||
|
|
||||||
|
This commit fixes that by always allocating a new
|
||||||
|
FreedesktopNotification before invoking dbus_call(), ensuring that the
|
||||||
|
callback always have a valid user data.
|
||||||
|
|
||||||
|
Signed-off-by: Arnaud Rebillout <elboulangero@gmail.com>
|
||||||
|
---
|
||||||
|
gio/gfdonotificationbackend.c | 55 ++++++++++++++++++++++++++-----------------
|
||||||
|
1 file changed, 34 insertions(+), 21 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/gio/gfdonotificationbackend.c b/gio/gfdonotificationbackend.c
|
||||||
|
index a0d4814335be..ab5329497d1e 100644
|
||||||
|
--- a/gio/gfdonotificationbackend.c
|
||||||
|
+++ b/gio/gfdonotificationbackend.c
|
||||||
|
@@ -62,7 +62,6 @@ typedef struct
|
||||||
|
GVariant *default_action_target;
|
||||||
|
} FreedesktopNotification;
|
||||||
|
|
||||||
|
-
|
||||||
|
static void
|
||||||
|
freedesktop_notification_free (gpointer data)
|
||||||
|
{
|
||||||
|
@@ -76,6 +75,24 @@ freedesktop_notification_free (gpointer data)
|
||||||
|
g_slice_free (FreedesktopNotification, n);
|
||||||
|
}
|
||||||
|
|
||||||
|
+static FreedesktopNotification *
|
||||||
|
+freedesktop_notification_new (GFdoNotificationBackend *backend,
|
||||||
|
+ const gchar *id,
|
||||||
|
+ GNotification *notification)
|
||||||
|
+{
|
||||||
|
+ FreedesktopNotification *n;
|
||||||
|
+
|
||||||
|
+ n = g_slice_new0 (FreedesktopNotification);
|
||||||
|
+ n->backend = backend;
|
||||||
|
+ n->id = g_strdup (id);
|
||||||
|
+ n->notify_id = 0;
|
||||||
|
+ g_notification_get_default_action (notification,
|
||||||
|
+ &n->default_action,
|
||||||
|
+ &n->default_action_target);
|
||||||
|
+
|
||||||
|
+ return n;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
static FreedesktopNotification *
|
||||||
|
g_fdo_notification_backend_find_notification (GFdoNotificationBackend *backend,
|
||||||
|
const gchar *id)
|
||||||
|
@@ -319,8 +336,19 @@ notification_sent (GObject *source_object,
|
||||||
|
val = g_dbus_connection_call_finish (G_DBUS_CONNECTION (source_object), result, &error);
|
||||||
|
if (val)
|
||||||
|
{
|
||||||
|
+ GFdoNotificationBackend *backend = n->backend;
|
||||||
|
+ FreedesktopNotification *match;
|
||||||
|
+
|
||||||
|
g_variant_get (val, "(u)", &n->notify_id);
|
||||||
|
g_variant_unref (val);
|
||||||
|
+
|
||||||
|
+ match = g_fdo_notification_backend_find_notification_by_notify_id (backend, n->notify_id);
|
||||||
|
+ if (match != NULL)
|
||||||
|
+ {
|
||||||
|
+ backend->notifications = g_slist_remove (backend->notifications, match);
|
||||||
|
+ freedesktop_notification_free (match);
|
||||||
|
+ }
|
||||||
|
+ backend->notifications = g_slist_prepend (backend->notifications, n);
|
||||||
|
}
|
||||||
|
else
|
||||||
|
{
|
||||||
|
@@ -331,9 +359,7 @@ notification_sent (GObject *source_object,
|
||||||
|
warning_printed = TRUE;
|
||||||
|
}
|
||||||
|
|
||||||
|
- n->backend->notifications = g_slist_remove (n->backend->notifications, n);
|
||||||
|
freedesktop_notification_free (n);
|
||||||
|
-
|
||||||
|
g_error_free (error);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -378,7 +404,7 @@ g_fdo_notification_backend_send_notification (GNotificationBackend *backend,
|
||||||
|
GNotification *notification)
|
||||||
|
{
|
||||||
|
GFdoNotificationBackend *self = G_FDO_NOTIFICATION_BACKEND (backend);
|
||||||
|
- FreedesktopNotification *n;
|
||||||
|
+ FreedesktopNotification *n, *tmp;
|
||||||
|
|
||||||
|
if (self->notify_subscription == 0)
|
||||||
|
{
|
||||||
|
@@ -391,24 +417,11 @@ g_fdo_notification_backend_send_notification (GNotificationBackend *backend,
|
||||||
|
notify_signal, backend, NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
- n = g_fdo_notification_backend_find_notification (self, id);
|
||||||
|
- if (n == NULL)
|
||||||
|
- {
|
||||||
|
- n = g_slice_new0 (FreedesktopNotification);
|
||||||
|
- n->backend = self;
|
||||||
|
- n->id = g_strdup (id);
|
||||||
|
- n->notify_id = 0;
|
||||||
|
-
|
||||||
|
- n->backend->notifications = g_slist_prepend (n->backend->notifications, n);
|
||||||
|
- }
|
||||||
|
- else
|
||||||
|
- {
|
||||||
|
- /* Only clear default action. All other fields are still valid */
|
||||||
|
- g_clear_pointer (&n->default_action, g_free);
|
||||||
|
- g_clear_pointer (&n->default_action_target, g_variant_unref);
|
||||||
|
- }
|
||||||
|
+ n = freedesktop_notification_new (self, id, notification);
|
||||||
|
|
||||||
|
- g_notification_get_default_action (notification, &n->default_action, &n->default_action_target);
|
||||||
|
+ tmp = g_fdo_notification_backend_find_notification (self, id);
|
||||||
|
+ if (tmp)
|
||||||
|
+ n->notify_id = tmp->notify_id;
|
||||||
|
|
||||||
|
call_notify (backend->dbus_connection, backend->application, n->notify_id, notification, notification_sent, n);
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.14.4
|
||||||
|
|
||||||
15
glib2.spec
15
glib2.spec
@ -5,7 +5,7 @@
|
|||||||
|
|
||||||
Name: glib2
|
Name: glib2
|
||||||
Version: 2.56.1
|
Version: 2.56.1
|
||||||
Release: 3%{?dist}
|
Release: 4%{?dist}
|
||||||
Summary: A library of handy utility functions
|
Summary: A library of handy utility functions
|
||||||
|
|
||||||
License: LGPLv2+
|
License: LGPLv2+
|
||||||
@ -14,7 +14,12 @@ Source0: http://download.gnome.org/sources/glib/2.56/glib-%{version}.tar.xz
|
|||||||
|
|
||||||
# Include upstream patch to fix gdbus-codegen when used with meson 0.46
|
# Include upstream patch to fix gdbus-codegen when used with meson 0.46
|
||||||
# https://gitlab.gnome.org/GNOME/glib/commit/cd1f82d8fc741a2203582c12cc21b4dacf7e1872
|
# https://gitlab.gnome.org/GNOME/glib/commit/cd1f82d8fc741a2203582c12cc21b4dacf7e1872
|
||||||
Patch0: 00-fix-gdbus-codegen.patch
|
Patch0: glib2-fix-gdbus-codegen.patch
|
||||||
|
|
||||||
|
# https://gitlab.gnome.org/GNOME/glib/merge_requests/90
|
||||||
|
# https://gitlab.gnome.org/GNOME/glib/merge_requests/102
|
||||||
|
# https://bugzilla.redhat.com/show_bug.cgi?id=1584916
|
||||||
|
Patch1: glib2-gfdonotificationbackend-fix-possible-invalid-pointer.patch
|
||||||
|
|
||||||
BuildRequires: chrpath
|
BuildRequires: chrpath
|
||||||
BuildRequires: gettext
|
BuildRequires: gettext
|
||||||
@ -219,8 +224,12 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
|
|||||||
%{_datadir}/installed-tests
|
%{_datadir}/installed-tests
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Jun 14 2018 Debarshi Ray <rishi@fedoraproject.org> - 2.56.1-4
|
||||||
|
- Backport patch to fix possible invalid pointer in dbus callback in the FD.o
|
||||||
|
notification backend (RH #1584916)
|
||||||
|
|
||||||
* Sun May 27 2018 Kalev Lember <klember@redhat.com> - 2.56.1-3
|
* Sun May 27 2018 Kalev Lember <klember@redhat.com> - 2.56.1-3
|
||||||
- Fix multilib -devel installs (#1581067)
|
- Fix multilib -devel installs (RH #1581067)
|
||||||
|
|
||||||
* Sun May 13 2018 Fabio Valentini <decathorpe@gmail.com> - 2.56.1-2
|
* Sun May 13 2018 Fabio Valentini <decathorpe@gmail.com> - 2.56.1-2
|
||||||
- Include upstream patch to fix gdbus-codegen with meson 0.46.
|
- Include upstream patch to fix gdbus-codegen with meson 0.46.
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user