AuroraMiddleware/gtk2
1
0
Fork 0
forked from AuroraMiddleware/gtk
Code Issues Pull Requests Projects Releases Wiki Activity

Guard against selection requestor disappearing

Browse Source 
We made a number of unchecked accesses to the selection requestor,
which could cause X errors if the selection requestor vanished
(or we were sent invalid events). Add error traps around all of them.

See https://bugzilla.redhat.com/show_bug.cgi?id=1210814 for an
example of a crash that could be caused by this. (There are about
1000 instances of such a crash in http://retrace.fedoraproject.org
though no linked bug reports specifically talk about cut-and-paste
or DND.)

https://bugzilla.gnome.org/show_bug.cgi?id=756881
This commit is contained in:
Owen W. Taylor 2015-10-20 12:39:57 -04:00
parent d3bf602c60
commit 01136618b8
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
gtk/gtkselection.c
View File

@ -2474,23 +2474,27 @@ _gtk_selection_request (GtkWidget *widget,
info->conversions[i].data = data;
info->num_incrs++;
gdk_error_trap_push ();
gdk_property_change (info->requestor,
info->conversions[i].property,
gtk_selection_atoms[INCR],
32,
GDK_PROP_MODE_REPLACE,
(guchar *)&items, 1);
gdk_error_trap_pop_ignored ();
}
else
{
info->conversions[i].offset = -1;
gdk_error_trap_push ();
gdk_property_change (info->requestor,
info->conversions[i].property,
data.type,
data.format,
GDK_PROP_MODE_REPLACE,
data.data, items);
gdk_error_trap_pop_ignored ();
g_free (data.data);
}
@ -2510,9 +2514,11 @@ _gtk_selection_request (GtkWidget *widget,
g_message ("Starting INCR...");
#endif
gdk_error_trap_push ();
gdk_window_set_events (info->requestor,
gdk_window_get_events (info->requestor) |
GDK_PROPERTY_CHANGE_MASK);
gdk_error_trap_pop_ignored ();
current_incrs = g_list_append (current_incrs, info);
id = gdk_threads_add_timeout (1000, (GSourceFunc) gtk_selection_incr_timeout, info);
g_source_set_name_by_id (id, "[gtk+] gtk_selection_incr_timeout");
@ -2529,10 +2535,12 @@ _gtk_selection_request (GtkWidget *widget,
mult_atoms[2*i+1] = info->conversions[i].property;
}
gdk_error_trap_push ();
gdk_property_change (info->requestor, event->property,
gdk_atom_intern_static_string ("ATOM_PAIR"), 32,
GDK_PROP_MODE_REPLACE,
(guchar *)mult_atoms, 2*info->num_conversions);
gdk_error_trap_pop_ignored ();
g_free (mult_atoms);
}
@ -2656,12 +2664,14 @@ _gtk_selection_incr_event (GdkWindow *window,
#endif
bytes_per_item = gtk_selection_bytes_per_item (info->conversions[i].data.format);
gdk_error_trap_push ();
gdk_property_change (info->requestor, event->atom,
info->conversions[i].data.type,
info->conversions[i].data.format,
GDK_PROP_MODE_REPLACE,
buffer,
num_bytes / bytes_per_item);
gdk_error_trap_pop_ignored ();
if (info->conversions[i].offset == -2)
{