gsocketclient: Fix a use-after-free in g_socket_client_connected_callback()

The ref held by `data->task` may be the last one on the `GTask`. The
`GTask` stores `attempt->data` as its task data, and so when the `GTask`
is finalised, `attempt->data` is too. `connection_attempt_remove()`
needs to access `attempt->data`, so must be called before the
`g_object_unref()` in this situation.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Fixes: #3266
This commit is contained in:
Philip Withnall 2024-02-26 15:26:03 +00:00
parent 5b022f903c
commit 9a661ab970

View File

@ -1931,9 +1931,9 @@ g_socket_client_connected_callback (GObject *source,
if (task_completed_or_cancelled (data) || g_cancellable_is_cancelled (attempt->cancellable)) if (task_completed_or_cancelled (data) || g_cancellable_is_cancelled (attempt->cancellable))
{ {
g_object_unref (data->task);
connection_attempt_remove (attempt); connection_attempt_remove (attempt);
connection_attempt_unref (attempt); connection_attempt_unref (attempt);
g_object_unref (data->task);
return; return;
} }