summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Catanzaro <mcatanzaro@gnome.org>2021-04-08 12:43:18 -0500
committerMichael Catanzaro <mcatanzaro@gnome.org>2021-04-08 12:43:18 -0500
commit586ad68a954fbb752a0e602d5f379e7cd25f6567 (patch)
tree0d6410a9573c33f5bf02531bbf4873d7f1c4a98f
parenta98d4eeca6f31b1b000bf00e04ab3eeebbf8e2d4 (diff)
downloadepiphany-mcatanzaro/firefox-bookmarks-import.tar.gz
Fix crash when importing bookmarks from Firefoxmcatanzaro/firefox-bookmarks-import
The problem is the strings returned by get_firefox_profiles() are freed with g_free(), which is correct, but we are actually returning pointers into the middle of the allocated region, rather than pointers to the start of the string. Truncating a string using pointer arithmetic is a nice trick for unowned strings, but for owned strings it doesn't work. https://bugzilla.redhat.com/show_bug.cgi?id=1946648
-rw-r--r--src/window-commands.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/src/window-commands.c b/src/window-commands.c
index 8353008a9..6f46496e5 100644
--- a/src/window-commands.c
+++ b/src/window-commands.c
@@ -138,22 +138,24 @@ static gchar *
get_path (GIOChannel *channel)
{
gchar *line;
- gchar *path;
+ const gchar *path;
+ gchar *result;
gsize length;
do {
g_io_channel_read_line (channel, &line, &length, NULL, NULL);
if (g_str_has_prefix (line, "Path")) {
- path = g_strdup (line);
+ path = line;
/* Extract value (e.g. Path=Value\n -> Value) */
path = strchr (path, '=');
path++;
- path[strcspn (path, "\n")] = 0;
+ ((gchar *)path)[strcspn (path, "\n")] = '\0';
+ result = g_strdup (path);
g_free (line);
- return path;
+ return result;
}
g_free (line);