mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-11 05:10:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fp-device: Fix double free in device finalization with pending timeout sources

Browse Source 
fp_device_finalize calls g_slist_free_full() to destroy any still-pending
timeout sources.
Each g_source_destroy call triggers timeout_finalize, which tries to
remove the current source from the sources list.
This may lead to a double-free, as iterating over a list deleting items
is not supported.

Add a regression test that adds a timeout with a long delay and immediately
finalizes the device while the timeout is still pending.
This commit is contained in:
Marco Trevisan (Treviño)
2026-07-12 13:17:35 +02:00
parent 55b934b02e
commit dac36a8d59
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/fp-device.c
+1 -1
View File
@@ -221,7 +221,7 @@ fp_device_finalize (GObject *object)
g_clear_pointer (&priv->temp_timeout, g_source_destroy); g_clear_pointer (&priv->temp_timeout, g_source_destroy);
g_slist_free_full (priv->sources, (GDestroyNotify) g_source_destroy); g_clear_slist (&priv->sources, (GDestroyNotify) g_source_destroy);
g_clear_pointer (&priv->current_idle_cancel_source, g_source_destroy); g_clear_pointer (&priv->current_idle_cancel_source, g_source_destroy);
g_clear_pointer (&priv->current_task_idle_return_source, g_source_destroy); g_clear_pointer (&priv->current_task_idle_return_source, g_source_destroy);