Fix nasty double free crashes
authorKlaus Ethgen <Klaus@Ethgen.de>
Mon, 15 Feb 2016 21:09:52 +0000 (22:09 +0100)
committerKlaus Ethgen <Klaus@Ethgen.de>
Mon, 15 Feb 2016 21:30:02 +0000 (22:30 +0100)
Old GTK+ versions seemed to be robust about this double free so we seen
that crashes or 100% CPU usages just with modern versions.

This patch takes care of it on two places:
1. Hashes will not be freed by g_hash_table_destroy when empty
2. NULLify the enty variable after free

src/collect-io.c

index 1f6cf05..bb9967d 100644 (file)
@@ -497,8 +497,14 @@ static void collect_manager_entry_free_data(CollectManagerEntry *entry)
                collect_manager_action_unref(action);
                }
        g_list_free(entry->add_list);
-       g_hash_table_destroy(entry->oldpath_hash);
-       g_hash_table_destroy(entry->newpath_hash);
+       if (g_hash_table_size(entry->oldpath_hash) > 0)
+               g_hash_table_destroy(entry->oldpath_hash);
+       else
+               g_hash_table_unref(entry->oldpath_hash);
+       if (g_hash_table_size(entry->newpath_hash) > 0)
+               g_hash_table_destroy(entry->newpath_hash);
+       else
+               g_hash_table_unref(entry->newpath_hash);
 }
 
 static void collect_manager_entry_init_data(CollectManagerEntry *entry)
@@ -704,6 +710,8 @@ static void collect_manager_refresh(void)
                        else
                                {
                                collect_manager_entry_free(entry);
+
+                               entry = NULL;
                                }
                        }
                }