forked from AuroraMiddleware/gtk
806c04411d
Running gnome-shell under valgrind, I saw the attached invalid write. Basically we can destroy a window during event processing, and the old window_remove_filters simply called g_free() on the filter, ignoring the refcount. Then later in event processing we call filter->refcount--, which is writing to free()d memory. Fix this by centralizing list mutation and refcount handling inside a new shared _gdk_window_filter_unref() function, and using that everywhere. ==13876== Invalid write of size 4 ==13876== at 0x446B181: gdk_event_apply_filters (gdkeventsource.c:86) ==13876== by 0x446B411: _gdk_events_queue (gdkeventsource.c:188) ==13876== by 0x44437EF: gdk_display_get_event (gdkdisplay.c:410) ==13876== by 0x446B009: gdk_event_source_dispatch (gdkeventsource.c:317) ==13876== by 0x4AB7159: g_main_context_dispatch (gmain.c:2436) ==13876== by 0x4AB7957: g_main_context_iterate.clone.5 (gmain.c:3087) ==13876== by 0x4AB806A: g_main_loop_run (gmain.c:3295) ==13876== by 0x8084D6B: main (main.c:722) ==13876== Address 0x1658bcac is 12 bytes inside a block of size 16 free'd ==13876== at 0x4005EAD: free (vg_replace_malloc.c:366) ==13876== by 0x4ABE515: g_free (gmem.c:263) ==13876== by 0x444BCC9: window_remove_filters (gdkwindow.c:1873) ==13876== by 0x4454BA3: _gdk_window_destroy_hierarchy (gdkwindow.c:2043) ==13876== by 0x447BF6E: gdk_window_destroy_notify (gdkwindow-x11.c:1115) ==13876== by 0x43588E2: _gtk_socket_windowing_filter_func (gtksocket-x11.c:518) ==13876== by 0x446B170: gdk_event_apply_filters (gdkeventsource.c:79) ==13876== by 0x446B411: _gdk_events_queue (gdkeventsource.c:188) ==13876== by 0x44437EF: gdk_display_get_event (gdkdisplay.c:410) ==13876== by 0x446B009: gdk_event_source_dispatch (gdkeventsource.c:317) ==13876== by 0x4AB7159: g_main_context_dispatch (gmain.c:2436) ==13876== by 0x4AB7957: g_main_context_iterate.clone.5 (gmain.c:3087) https://bugzilla.gnome.org/show_bug.cgi?id=637464 |
||
|---|---|---|
| .. | ||
| checksettings.c | ||
| gdkapplaunchcontext-x11.c | ||
| gdkasync.c | ||
| gdkasync.h | ||
| gdkcursor-x11.c | ||
| gdkdevice-core.c | ||
| gdkdevice-core.h | ||
| gdkdevice-xi2.c | ||
| gdkdevice-xi2.h | ||
| gdkdevice-xi.c | ||
| gdkdevice-xi.h | ||
| gdkdevicemanager-core.c | ||
| gdkdevicemanager-core.h | ||
| gdkdevicemanager-x11.c | ||
| gdkdevicemanager-xi2.c | ||
| gdkdevicemanager-xi2.h | ||
| gdkdevicemanager-xi.c | ||
| gdkdevicemanager-xi.h | ||
| gdkdisplay-x11.c | ||
| gdkdisplay-x11.h | ||
| gdkdnd-x11.c | ||
| gdkeventsource.c | ||
| gdkeventsource.h | ||
| gdkeventtranslator.c | ||
| gdkeventtranslator.h | ||
| gdkgeometry-x11.c | ||
| gdkglobals-x11.c | ||
| gdkim-x11.c | ||
| gdkkeys-x11.c | ||
| gdkmain-x11.c | ||
| gdkprivate-x11.h | ||
| gdkproperty-x11.c | ||
| gdkscreen-x11.c | ||
| gdkscreen-x11.h | ||
| gdkselection-x11.c | ||
| gdksettings.c | ||
| gdkspawn-x11.c | ||
| gdktestutils-x11.c | ||
| gdkvisual-x11.c | ||
| gdkwindow-x11.c | ||
| gdkwindow-x11.h | ||
| gdkx.h | ||
| gdkxftdefaults.c | ||
| gdkxid.c | ||
| Makefile.am | ||
| MwmUtil.h | ||
| xsettings-client.c | ||
| xsettings-client.h | ||
| xsettings-common.c | ||
| xsettings-common.h | ||