From 6747ec55dd199ba037b636a7dde6ecdefe073e1b Mon Sep 17 00:00:00 2001 From: Elliott Sales de Andrade Date: Thu, 31 Jan 2019 16:46:38 -0500 Subject: [PATCH] Fix a possible use-after-free. If g_mapped_file_new fails, then `version` will be freed, but it was already added to the hash table. This means there could be a use-after-free while doing a lookup on the hash table the next time. --- girepository.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/girepository.c b/girepository.c index bc9e4ed54..ca5dc2b9b 100644 --- a/girepository.c +++ b/girepository.c @@ -1405,7 +1405,6 @@ enumerate_namespace_versions (const gchar *namespace, g_free (version); continue; } - g_hash_table_insert (found_versions, version, version); path = g_build_filename (dirname, entry, NULL); mfile = g_mapped_file_new (path, FALSE, &error); @@ -1422,6 +1421,7 @@ enumerate_namespace_versions (const gchar *namespace, candidate->path = path; candidate->version = version; candidates = g_slist_prepend (candidates, candidate); + g_hash_table_add (found_versions, version); } g_dir_close (dir); index++;