http://bugzilla.moblin.org/show_bug.cgi?id=4919 Summary: GTK-UI: memory use-after-free when server cannot be started Classification: Moblin Projects Product: SyncEvolution Version: upstream Platform: Netbook OS/Version: Moblin Linux Status: ASSIGNED Severity: normal Priority: P2 Component: * Feature Request AssignedTo: jku(a)linux.intel.com ReportedBy: patrick.ohly(a)intel.com CC: syncevolution(a)lists.intel.com If the syncevo-dbus-server cannot be started, then sync-ui runs into a use-after-free error and may crash. The chain of events is like this: * syncevo_service_get_server_config_async(): create data * get_server_config_async_error(): called, frees data * get_server_config_async_error(): called again with same data pointer, now invalid Here's the valgrind report (only appears when running with G_SLICE=always-malloc G_DEBUG=gc-friendly): ==18845== Invalid read of size 8 ==18845== at 0x411F4B: get_server_config_async_error (syncevo-dbus.c:664) ==18845== by 0x66A5209: g_main_context_dispatch (gmain.c:1814) ==18845== by 0x66A88DF: g_main_context_iterate (gmain.c:2448) ==18845== by 0x66A8DAC: g_main_loop_run (gmain.c:2656) ==18845== by 0x4F61BC6: gtk_main (gtkmain.c:1205) ==18845== by 0x405E8E: main (main.c:113) ==18845== Address 0xde31a40 is 8 bytes inside a block of size 24 free'd ==18845== at 0x4C265AF: free (vg_replace_malloc.c:323) ==18845== by 0x411F7A: get_server_config_async_error (syncevo-dbus.c:668) ==18845== by 0x66A5209: g_main_context_dispatch (gmain.c:1814) ==18845== by 0x66A88DF: g_main_context_iterate (gmain.c:2448) ==18845== by 0x66A8DAC: g_main_loop_run (gmain.c:2656) ==18845== by 0x4F61BC6: gtk_main (gtkmain.c:1205) ==18845== by 0x405E8E: main (main.c:113) { <insert a suppression name here> Memcheck:Addr8 fun:get_server_config_async_error fun:g_main_context_dispatch fun:g_main_context_iterate .... I'm not sure what the right memory handling for data is. As a workaround I have removed the g_slice_delete(). Better leak some memory instead of crashing... Jussi, please check this. -- Configure bugmail: http://bugzilla.moblin.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching someone on the CC list of the bug.