summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBarnabás Pőcze <pobrn@protonmail.com>2023-01-08 19:38:54 +0100
committerBarnabás Pőcze <pobrn@protonmail.com>2023-01-08 19:56:49 +0100
commitab5a6ed0f17d925c8e93729620ed7516093081a5 (patch)
tree06b2bd04045547b2e2172934fd6eb54ce1ca3690
parent5a3156a8b7904cceac9851a873f1b214fcfbfdd0 (diff)
downloadgtk+-ab5a6ed0f17d925c8e93729620ed7516093081a5.tar.gz
a11y: Check if path is NULL when removing from cache
`gtk_at_spi_cache_add_context()` checks if the GtkAtSpiContext's path is NULL before inserting the context object into the hash table. Do the same in `gtk_at_spi_cache_remove_context()` to avoid a NULL pointer dereference in `g_str_hash()` during the hash table lookup if a context with NULL path is removed. That can happen when the GtkAtSpiRoot::base_path is NULL, which, in turn, can happen if `g_application_get_dbus_object_path()` returns NULL. ==394047==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7fd1966f8b84 bp 0x7fff11e3ded0 sp 0x7fff11e3de58 T0) ==394047==The signal is caused by a READ memory access. ==394047==Hint: address points to the zero page. #0 0x7fd1966f8b84 in g_str_hash (/usr/lib/libglib-2.0.so.0+0x37b84) #1 0x7fd1966f9c09 in g_hash_table_contains (/usr/lib/libglib-2.0.so.0+0x38c09) #2 0x7fd196062c10 in gtk_at_spi_cache_remove_context ../gtk/a11y/gtkatspicache.c:447 #3 0x7fd19606e0a9 in gtk_at_spi_root_unregister ../gtk/a11y/gtkatspiroot.c:653 #4 0x7fd196067f58 in gtk_at_spi_context_unrealize ../gtk/a11y/gtkatspicontext.c:1559 #5 0x7fd195ced97f in gtk_at_context_unrealize ../gtk/gtkatcontext.c:668 #6 0x7fd195f5576e in gtk_widget_unroot_at_context ../gtk/gtkwidget.c:2399 #7 0x7fd195f55bd2 in gtk_widget_unroot ../gtk/gtkwidget.c:2499 ...
-rw-r--r--gtk/a11y/gtkatspicache.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/gtk/a11y/gtkatspicache.c b/gtk/a11y/gtkatspicache.c
index 3b16f24d6f..c24d55923f 100644
--- a/gtk/a11y/gtkatspicache.c
+++ b/gtk/a11y/gtkatspicache.c
@@ -444,6 +444,9 @@ gtk_at_spi_cache_remove_context (GtkAtSpiCache *self,
g_return_if_fail (GTK_IS_AT_SPI_CONTEXT (context));
const char *path = gtk_at_spi_context_get_context_path (context);
+ if (path == NULL)
+ return;
+
if (!g_hash_table_contains (self->contexts_by_path, path))
return;