callisto-debian/gtk3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gtkmountoperation: avoid SEGV after bad password input

Browse Source 
I observed the following nautilus crash below after trying to access an SMB
share and mistyping my password (it also happens if mounting the SMB share
fails for other reasons after entering a password). The crash happens when
the password entry window pops up the second time, in this code path, at
the 7th element of priv->user_widgets:

458	pw_dialog_anonymous_toggled (GtkWidget         *widget,
459	                             GtkMountOperation *operation)
460	{
...
472	  for (l = priv->user_widgets; l != NULL; l = l->next)
473	    {
474	      gtk_widget_set_sensitive (GTK_WIDGET (l->data), !priv->anonymous);
475	    }

The broken element had l->data = 0xaaaaaaaaaaaa, which means the pointer had
been freed.

The broken list entries were at the of the list because when
gtk_mount_operation_ask_password_do_gtk() constucts the pop-up the 2nd time,
it prepends new widgets:

gtk_mount_operation_ask_password_do_gtk()
   table_add_entry
       operation->priv->user_widgets = g_list_prepend (operation->priv->user_widgets, entry);

The problem is that in pw_dialog_got_response(), the widget is destroyed,
which also destroys all child widgets, but the priv->user_widgets list is
neither freed nor set to NULL.

Fix it.
This commit is contained in:
Martin Wilck 2023-06-02 15:16:58 +02:00
parent 0f990e8157
commit 1d95b8ab26
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
gtk/gtkmountoperation.c
View File

@ -380,6 +380,11 @@ pw_dialog_got_response (GtkDialog *dialog,
else
g_mount_operation_reply (op, G_MOUNT_OPERATION_ABORTED);
if (priv->user_widgets)
{
g_list_free (priv->user_widgets);
priv->user_widgets = NULL;
}
priv->dialog = NULL;
g_object_notify (G_OBJECT (op), "is-showing");
gtk_widget_destroy (GTK_WIDGET (dialog));