luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-02-15 23:07:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

gparamspecs: Fix NULL pointer dereference

Browse Source 
I’m not sure exactly how this code is supposed to work, so this might
not be the right fix. But there’s definitely a problem here, and it was
spotted by scan-build.

If `param_value_array_validate()` is entered with
`value->data[0].v_pointer == NULL && aspec->fixed_n_elements`, that `NULL`
will be stored in `value_array` too. `value->data[0].v_pointer` will
then be set to a new non-`NULL` array.

A few lines down, `value_array_ensure_size()` is called on
`value_array` – which is still `NULL` – and this results in a `NULL`
pointer dereference.

It looks like `value->data[0].v_pointer` and `value_array` are used
interchangeably throughout the whole of the function, so assign the new
value of `value->data[0].v_pointer` to `value_array` too.

My guess is that `value_array` is just a convenience alias for
`value->data[0].v_pointer`, because the latter is a real mouthful to
type or read.

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Helps: #1767
This commit is contained in:
Philip Withnall 2024-04-12 16:01:20 +01:00
parent 7c7c00635e
commit dc2027e728
No known key found for this signature in database
GPG Key ID: DCDF5885B1F3ED73
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
gobject/gparamspecs.c
View File

@ -1018,7 +1018,7 @@ param_value_array_validate (GParamSpec *pspec,
guint changed = 0;
if (!value->data[0].v_pointer && aspec->fixed_n_elements)
value->data[0].v_pointer = g_value_array_new (aspec->fixed_n_elements);
value_array = value->data[0].v_pointer = g_value_array_new (aspec->fixed_n_elements);
if (value->data[0].v_pointer)
{