ephy-web-view: fix use-after-free in get_file_content_as_base64()

image_type is owned by file_info, so we can't free file_info until
after we're done with image_type.  Fixes crash when error page
is displayed.  Valgrind trace:

==1916== Invalid read of size 1
==1916==    at 0x38CBA7B328: _IO_default_xsputn (in /lib64/libc-2.14.90.so)
==1916==    by 0x38CBA4B3A7: vfprintf (in /lib64/libc-2.14.90.so)
==1916==    by 0x38CBB084B0: __vasprintf_chk (in /lib64/libc-2.14.90.so)
==1916==    by 0x38CDA8A44A: g_vasprintf (stdio2.h:199)
==1916==    by 0x38CDA69B0C: g_strdup_vprintf (gstrfuncs.c:509)
==1916==    by 0x38CDA69BAB: g_strdup_printf (gstrfuncs.c:535)
==1916==    by 0x47EA57: ephy_web_view_load_error_page (ephy-web-view.c:1978)
==1916==    by 0x47F6B2: load_error_cb (ephy-web-view.c:2119)
==1916==    by 0x38E8E7753F: webkit_marshal_BOOLEAN__OBJECT_STRING_POINTER (in /usr/lib64/libwebkitgtk-3.0.so.0.11.0)
==1916==    by 0x38CEA11381: g_closure_invoke (gclosure.c:777)
==1916==    by 0x38CEA23132: signal_emit_unlocked_R (gsignal.c:3547)
==1916==    by 0x38CEA2AEE1: g_signal_emit_valist (gsignal.c:3306)
==1916==  Address 0x4f02040 is 0 bytes inside a block of size 10 free'd
==1916==    at 0x4A0662E: free (vg_replace_malloc.c:366)
==1916==    by 0x38CDA5513E: g_free (gmem.c:252)
==1916==    by 0x38D1255908: _g_file_attribute_value_clear (gfileattribute.c:245)
==1916==    by 0x38D125A078: g_file_info_finalize (gfileinfo.c:324)
==1916==    by 0x38CEA1670F: g_object_unref (gobject.c:3018)
==1916==    by 0x47EA05: ephy_web_view_load_error_page (ephy-web-view.c:1974)
==1916==    by 0x47F6B2: load_error_cb (ephy-web-view.c:2119)
==1916==    by 0x38E8E7753F: webkit_marshal_BOOLEAN__OBJECT_STRING_POINTER (in /usr/lib64/libwebkitgtk-3.0.so.0.11.0)
==1916==    by 0x38CEA11381: g_closure_invoke (gclosure.c:777)
==1916==    by 0x38CEA23132: signal_emit_unlocked_R (gsignal.c:3547)
==1916==    by 0x38CEA2AEE1: g_signal_emit_valist (gsignal.c:3306)
==1916==    by 0x38CEA2BE83: g_signal_emit_by_name (gsignal.c:3389)

https://bugzilla.gnome.org/show_bug.cgi?id=677736

1 files changed, 3 insertions, 3 deletions

diff --git a/embed/ephy-web-view.c b/embed/ephy-web-view.c
index e98e13d28..cf1efe31a 100644
--- a/embed/ephy-web-view.c
+++ b/embed/ephy-web-view.c
@@ -2070,9 +2070,6 @@ get_file_content_as_base64 (const char *path)
                                  NULL, NULL);
   image_type = g_file_info_get_content_type (file_info);
 
-  g_object_unref (file);
-  g_object_unref (file_info);
-
   g_file_get_contents (path, &image_raw, &len, NULL);
   image_data = g_base64_encode ((guchar *) image_raw, len);
   image64 = g_strdup_printf ("data:%s;base64,%s", image_type, image_data);
@@ -2080,6 +2077,9 @@ get_file_content_as_base64 (const char *path)
   g_free (image_raw);
   g_free (image_data);
 
+  g_object_unref (file);
+  g_object_unref (file_info);
+
   return image64;
 }