/cpw/tomkiewicz/masterpassword: d53bf5bde2c0: Fix use-after-free...

[Tomasz Wasilczyk]

Changeset: d53bf5bde2c04a5a0e639ed16840aa0c3bd748f0
Author:	 Tomasz Wasilczyk <tomkiewicz at cpw.pidgin.im>
Date:	 2013-03-25 16:41 +0100
Branch:	 soc.2008.masterpassword
URL: https://hg.pidgin.im/cpw/tomkiewicz/masterpassword/rev/d53bf5bde2c0

Description:

Fix use-after-free in error reporting

diffstat:

 libpurple/keyring.c |  19 +++++++++++++++----
 1 files changed, 15 insertions(+), 4 deletions(-)

diffs (57 lines):

diff --git a/libpurple/keyring.c b/libpurple/keyring.c
--- a/libpurple/keyring.c
+++ b/libpurple/keyring.c
@@ -58,7 +58,7 @@ struct _PurpleKeyring
 
 struct _PurpleKeyringChangeTracker
 {
-	GError *error;  /* could probably be dropped */
+	GError *error;
 	PurpleKeyringSetInUseCallback cb;
 	gpointer data;
 	const PurpleKeyring *new;
@@ -75,6 +75,14 @@ struct _PurpleKeyringCbInfo
 	gpointer data;
 };
 
+static void
+purple_keyring_change_tracker_free(PurpleKeyringChangeTracker *tracker)
+{
+	if (tracker->error)
+		g_error_free(tracker->error);
+	g_free(tracker);
+}
+
 /* Constructor */
 PurpleKeyring *
 purple_keyring_new(void)
@@ -445,7 +453,9 @@ purple_keyring_set_inuse_check_error_cb(
 					"Failed to communicate with backend while changing keyring for account %s: %s. Aborting changes.\n",
 					name, error->message);
 				tracker->abort = TRUE;
-				tracker->error = error;
+				if (tracker->error != NULL)
+					g_error_free(tracker->error);
+				tracker->error = g_error_copy(error);
 				break;
 
 			default:
@@ -453,7 +463,8 @@ purple_keyring_set_inuse_check_error_cb(
 					"Unknown error while changing keyring for account %s: %s. Aborting changes.\n",
 					name, error->message);
 				tracker->abort = TRUE;
-				tracker->error = error;
+				if (tracker->error == NULL)
+					tracker->error = g_error_copy(error);
 				break;
 		}
 	}
@@ -496,7 +507,7 @@ purple_keyring_set_inuse_check_error_cb(
 				tracker->cb(tracker->new, TRUE, NULL, tracker->data);
 		}
 
-		g_free(tracker);
+		purple_keyring_change_tracker_free(tracker);
 	}
 
 	/**