From 61babdee488bbd7c39567fdeb69743182c6bcb26 Mon Sep 17 00:00:00 2001 From: Mike Gorse Date: Tue, 16 Jun 2020 15:17:39 -0500 Subject: Fix use after free when an event listener is destroyed Properly remove event listeners from the list when they are deregistered. Fixes a crash that can happen when orca exits. Similar issue to https://gitlab.gnome.org/GNOME/at-spi2-core/issues/22 --- atspi/atspi-event-listener.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'atspi/atspi-event-listener.c') diff --git a/atspi/atspi-event-listener.c b/atspi/atspi-event-listener.c index 03e930ae..7d2db6a7 100644 --- a/atspi/atspi-event-listener.c +++ b/atspi/atspi-event-listener.c @@ -785,12 +785,9 @@ atspi_event_listener_deregister_from_callback (AtspiEventListenerCB callback, is_superset (name, e->name) && is_superset (detail, e->detail)) { - gboolean need_replace; DBusMessage *message, *reply; - need_replace = (l == event_listeners); - l = g_list_remove (l, e); - if (need_replace) - event_listeners = l; + l = g_list_next (l); + event_listeners = g_list_remove (event_listeners, e); for (i = 0; i < matchrule_array->len; i++) { char *matchrule = g_ptr_array_index (matchrule_array, i); @@ -809,7 +806,8 @@ atspi_event_listener_deregister_from_callback (AtspiEventListenerCB callback, listener_entry_free (e); } - else l = g_list_next (l); + else + l = g_list_next (l); } g_free (category); g_free (name); -- cgit v1.2.1