luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-09-28 01:57:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

g_dbus_connection_export_menu_model(): fix a crash

Browse Source 
Add some extra protection when 'preparing' a group that doesn't yet
contain any menus.  This can happen if you subscribe to a group that
doesn't yet exist.

It was possible to crash any application using
g_dbus_connection_export_menu_model() by requesting a non-existent
subscription group over the bus.

In practice this only happened in races -- where the proxy sees a group
that exists and queries it, but by the time it does, it's already gone.

https://bugzilla.gnome.org/show_bug.cgi?id=687089
This commit is contained in:
Ryan Lortie
2012-10-29 09:09:49 +01:00
parent 00f4c12bf9
commit f20ae7fcfd
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
gio/gmenuexporter.c
View File

@@ -357,6 +357,14 @@ g_menu_exporter_group_subscribe (GMenuExporterGroup *group,
group->prepared = TRUE; group->prepared = TRUE;
menu = g_hash_table_lookup (group->menus, 0); menu = g_hash_table_lookup (group->menus, 0);
/* If the group was created by a subscription and does not yet
* exist, it won't have a root menu...
*
* That menu will be prepared if it is ever added (due to
* group->prepared == TRUE).
*/
if (menu)
g_menu_exporter_menu_prepare (menu); g_menu_exporter_menu_prepare (menu);
} }
@@ -468,6 +476,7 @@ g_menu_exporter_remote_subscribe (GMenuExporterRemote *remote,
count = (gsize) g_hash_table_lookup (remote->watches, GINT_TO_POINTER (group_id)); count = (gsize) g_hash_table_lookup (remote->watches, GINT_TO_POINTER (group_id));
g_hash_table_insert (remote->watches, GINT_TO_POINTER (group_id), GINT_TO_POINTER (count + 1)); g_hash_table_insert (remote->watches, GINT_TO_POINTER (group_id), GINT_TO_POINTER (count + 1));
/* Group will be created (as empty/unsubscribed if it does not exist) */
group = g_menu_exporter_lookup_group (remote->exporter, group_id); group = g_menu_exporter_lookup_group (remote->exporter, group_id);
g_menu_exporter_group_subscribe (group, builder); g_menu_exporter_group_subscribe (group, builder);
} }