[Pidgin] #398: Crash when updating a buddy's icon on MSN

[Pidgin]

#398: Crash when updating a buddy's icon on MSN
---------------------------+------------------------------------------------
  Reporter:  nosnilmot     |       Owner:  seanegan
      Type:  defect        |      Status:  assigned
  Priority:  blocker       |   Milestone:  2.0.0   
 Component:  pidgin (gtk)  |     Version:  2.0     
Resolution:                |    Keywords:          
   Pending:  0             |  
---------------------------+------------------------------------------------
Comment (by evands):

 sadrul: I think your first patch would also do just fine; I just came to
 the same solution (not remembering until I'd done it that there was a
 "similar" ticket.. which turned out to be the same).  Here was my
 solution:
 {{{
 ============================================================
 --- libpurple/buddyicon.c       c38e0f7cf0053bd45d40f32f9e4926061b2cc553
 +++ libpurple/buddyicon.c       9e273bdd575ddbbc1e6bf44c738c728c90cfab92
 @@ -379,13 +379,16 @@ purple_buddy_icon_update(PurpleBuddyIcon
         account  = purple_buddy_icon_get_account(icon);
         username = purple_buddy_icon_get_username(icon);

 -       /* If no data exists, then call the functions below with NULL to
 -        * unset the icon.  They will then unref the icon and it should be
 -        * destroyed.  The only way it wouldn't be destroyed is if someone
 +       /* If no data exists (icon->img == NULL), then call the functions
 below
 +        * with NULL to unset the icon.  They will then unref the icon and
 it should
 +        * be destroyed.  The only way it wouldn't be destroyed is if
 someone
          * else is holding a reference to it, in which case they can kill
          * the icon when they realize it has no data. */
         icon_to_set = icon->img ? icon : NULL;

 +       /* Ensure that icon remains valid throughout */
 +       if (icon) purple_buddy_icon_ref(icon);
 +
         for (list = sl = purple_find_buddies(account, username);
              sl != NULL;
              sl = sl->next)
 @@ -395,7 +398,6 @@ purple_buddy_icon_update(PurpleBuddyIcon

                 purple_buddy_set_icon(buddy, icon_to_set);

 -
                 old_icon =
 g_strdup(purple_blist_node_get_string((PurpleBlistNode *)buddy,
 "buddy_icon"));
                 if (icon->img && purple_buddy_icons_is_caching())
 @@ -433,6 +435,9 @@ purple_buddy_icon_update(PurpleBuddyIcon

         if (conv != NULL)
                 purple_conv_im_set_icon(PURPLE_CONV_IM(conv),
 icon_to_set);
 +
 +       /* icon's refcount was incremented above */
 +       if (icon) purple_buddy_icon_unref(icon);
  }

  void
 }}}

 A more useful stack trace of this happening can be found in #536, which is
 a duplicate of this ticket.

-- 
Ticket URL: <http://developer.pidgin.im/ticket/398#comment:8>
Pidgin <http://pidgin.im>
Pidgin