diff options
| author | Lubomir Rintel <lkundrak@v3.sk> | 2015-03-27 08:27:33 +0100 |
|---|---|---|
| committer | Carlos Garnacho <carlosg@gnome.org> | 2015-04-13 13:26:40 +0200 |
| commit | 8dcdeb7230633d62226f8b4786abc70fb99f6370 (patch) | |
| tree | 66b37c39d7ad907681738324a57404710aab9a67 | |
| parent | 10780bdb63b1d7b7176a0ad86450b535bb39248b (diff) | |
| download | gnome-settings-daemon-8dcdeb7230633d62226f8b4786abc70fb99f6370.tar.gz | |
wacom: don't unref GdkDevices when we don't own a reference
Commit 9e17dced137ff2fd05ed97c82e90a7725e9f82d7 added a bunch of unrefs
which always unref the gdk_device after a g_object_get ("gdk-device").
That is wrong -- getting a property doesn't increase a refcount.
This causes the GdkDevices to be freed too early causing all sorts of
crashes due to use-after-free() conditions:
https://bugzilla.redhat.com/show_bug.cgi?id=1194037
https://bugzilla.gnome.org/show_bug.cgi?id=746866
| -rw-r--r-- | plugins/wacom/gsd-wacom-manager.c | 4 | ||||
| -rw-r--r-- | plugins/wacom/list-wacom.c | 1 |
2 files changed, 0 insertions, 5 deletions
diff --git a/plugins/wacom/gsd-wacom-manager.c b/plugins/wacom/gsd-wacom-manager.c index 9a293b99..c9726205 100644 --- a/plugins/wacom/gsd-wacom-manager.c +++ b/plugins/wacom/gsd-wacom-manager.c @@ -480,7 +480,6 @@ set_keep_aspect (GsdWacomDevice *device, gsd_device = gsd_x11_device_manager_lookup_gdk_device (GSD_X11_DEVICE_MANAGER (device_manager), gdk_device); monitor = gsd_device_mapper_get_device_monitor (mapper, gsd_device); - g_object_unref (gdk_device); /* Adjust area to match the monitor aspect ratio */ g_debug ("Initial device area: (%d,%d) (%d,%d)", area[0], area[1], area[2], area[3]); @@ -1343,7 +1342,6 @@ switch_monitor (GsdWacomManager *manager, g_object_get (device, "gdk-device", &gdk_device, NULL); gsd_device = gsd_x11_device_manager_lookup_gdk_device (GSD_X11_DEVICE_MANAGER (gsd_device_manager_get ()), gdk_device); - g_object_unref (gdk_device); current_monitor = gsd_device_mapper_get_device_monitor (manager->priv->device_mapper, gsd_device); @@ -1602,7 +1600,6 @@ check_need_for_calibration (GsdWacomDevice *device) gsd_device = gsd_x11_device_manager_lookup_gdk_device (GSD_X11_DEVICE_MANAGER (gsd_device_manager_get ()), gdk_device); monitor = gsd_device_mapper_get_device_monitor (mapper, gsd_device); - g_object_unref (gdk_device); if (monitor < 0) { geometry.width = gdk_screen_get_width (screen); @@ -1967,7 +1964,6 @@ gsd_wacom_manager_stop (GsdWacomManager *manager) g_object_get (device, "gdk-device", &gdk_device, NULL); grab_button (gdk_x11_device_get_id (gdk_device), FALSE, manager->priv->screen); - g_object_unref (gdk_device); } } diff --git a/plugins/wacom/list-wacom.c b/plugins/wacom/list-wacom.c index 4b15b9a4..d91c679a 100644 --- a/plugins/wacom/list-wacom.c +++ b/plugins/wacom/list-wacom.c @@ -196,7 +196,6 @@ get_edid (GsdWacomDevice *device) gsd_device = gsd_x11_device_manager_lookup_gdk_device (GSD_X11_DEVICE_MANAGER (gsd_device_manager_get ()), gdk_device); - g_object_unref (gdk_device); if (!gsd_device) goto bail; |