From dac36a8d5923737c302e9415d9e3818b4fe67457 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Tue, 7 Jul 2026 16:42:45 +0200 Subject: [PATCH] fp-device: Fix double free in device finalization with pending timeout sources fp_device_finalize calls g_slist_free_full() to destroy any still-pending timeout sources. Each g_source_destroy call triggers timeout_finalize, which tries to remove the current source from the sources list. This may lead to a double-free, as iterating over a list deleting items is not supported. Add a regression test that adds a timeout with a long delay and immediately finalizes the device while the timeout is still pending. --- libfprint/fp-device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libfprint/fp-device.c b/libfprint/fp-device.c index 4206663a..00ef2faa 100644 --- a/libfprint/fp-device.c +++ b/libfprint/fp-device.c @@ -221,7 +221,7 @@ fp_device_finalize (GObject *object) g_clear_pointer (&priv->temp_timeout, g_source_destroy); - g_slist_free_full (priv->sources, (GDestroyNotify) g_source_destroy); + g_clear_slist (&priv->sources, (GDestroyNotify) g_source_destroy); g_clear_pointer (&priv->current_idle_cancel_source, g_source_destroy); g_clear_pointer (&priv->current_task_idle_return_source, g_source_destroy);