Philip Withnall c4e3022918 gdbusmessage: Cache the arg0 value
Technically we can’t rely on it being kept alive by the `message->body`
pointer, unless we can guarantee that the `GVariant` is always
serialised. That’s not necessarily the case, so keep a separate ref on
the arg0 value at all times.

This avoids a potential use-after-free.

Spotted by Thomas Haller in
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3720#note_1924707.

[This is a prerequisite for having tests pass after fixing the
vulnerability described in glib#3268, because after fixing that
vulnerability, the use-after-free genuinely does happen during
regression testing. -smcv]

Signed-off-by: Philip Withnall <pwithnall@gnome.org>

Helps: #3183, #3268
(cherry picked from commit 10e9a917be7fb92b6b27837ef7a7f1d0be6095d5)
2024-05-07 18:45:07 +02:00
..
2022-09-20 12:19:56 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2021-11-24 15:06:46 +01:00
2021-10-04 10:29:08 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2019-07-15 16:07:18 -07:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2022-02-07 14:03:47 +00:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2018-09-12 14:35:16 +00:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2018-01-04 22:19:30 +01:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2020-11-11 13:15:21 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2019-01-31 19:00:19 -05:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2022-01-18 22:08:16 +04:00
2022-01-18 22:08:16 +04:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00
2017-05-29 19:53:34 +02:00