From c11e8f1c77127a75a842ba3d9a75ade1b6ba9d2b Mon Sep 17 00:00:00 2001 From: Dan Williams Date: Fri, 8 Jun 2012 17:09:36 -0500 Subject: ephy-web-view: fix use-after-free in get_file_content_as_base64() image_type is owned by file_info, so we can't free file_info until after we're done with image_type. Fixes crash when error page is displayed. Valgrind trace: ==1916== Invalid read of size 1 ==1916== at 0x38CBA7B328: _IO_default_xsputn (in /lib64/libc-2.14.90.so) ==1916== by 0x38CBA4B3A7: vfprintf (in /lib64/libc-2.14.90.so) ==1916== by 0x38CBB084B0: __vasprintf_chk (in /lib64/libc-2.14.90.so) ==1916== by 0x38CDA8A44A: g_vasprintf (stdio2.h:199) ==1916== by 0x38CDA69B0C: g_strdup_vprintf (gstrfuncs.c:509) ==1916== by 0x38CDA69BAB: g_strdup_printf (gstrfuncs.c:535) ==1916== by 0x47EA57: ephy_web_view_load_error_page (ephy-web-view.c:1978) ==1916== by 0x47F6B2: load_error_cb (ephy-web-view.c:2119) ==1916== by 0x38E8E7753F: webkit_marshal_BOOLEAN__OBJECT_STRING_POINTER (in /usr/lib64/libwebkitgtk-3.0.so.0.11.0) ==1916== by 0x38CEA11381: g_closure_invoke (gclosure.c:777) ==1916== by 0x38CEA23132: signal_emit_unlocked_R (gsignal.c:3547) ==1916== by 0x38CEA2AEE1: g_signal_emit_valist (gsignal.c:3306) ==1916== Address 0x4f02040 is 0 bytes inside a block of size 10 free'd ==1916== at 0x4A0662E: free (vg_replace_malloc.c:366) ==1916== by 0x38CDA5513E: g_free (gmem.c:252) ==1916== by 0x38D1255908: _g_file_attribute_value_clear (gfileattribute.c:245) ==1916== by 0x38D125A078: g_file_info_finalize (gfileinfo.c:324) ==1916== by 0x38CEA1670F: g_object_unref (gobject.c:3018) ==1916== by 0x47EA05: ephy_web_view_load_error_page (ephy-web-view.c:1974) ==1916== by 0x47F6B2: load_error_cb (ephy-web-view.c:2119) ==1916== by 0x38E8E7753F: webkit_marshal_BOOLEAN__OBJECT_STRING_POINTER (in /usr/lib64/libwebkitgtk-3.0.so.0.11.0) ==1916== by 0x38CEA11381: g_closure_invoke (gclosure.c:777) ==1916== by 0x38CEA23132: signal_emit_unlocked_R (gsignal.c:3547) ==1916== by 0x38CEA2AEE1: g_signal_emit_valist (gsignal.c:3306) ==1916== by 0x38CEA2BE83: g_signal_emit_by_name (gsignal.c:3389) https://bugzilla.gnome.org/show_bug.cgi?id=677736 --- embed/ephy-web-view.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'embed/ephy-web-view.c') diff --git a/embed/ephy-web-view.c b/embed/ephy-web-view.c index e98e13d28..cf1efe31a 100644 --- a/embed/ephy-web-view.c +++ b/embed/ephy-web-view.c @@ -2070,9 +2070,6 @@ get_file_content_as_base64 (const char *path) NULL, NULL); image_type = g_file_info_get_content_type (file_info); - g_object_unref (file); - g_object_unref (file_info); - g_file_get_contents (path, &image_raw, &len, NULL); image_data = g_base64_encode ((guchar *) image_raw, len); image64 = g_strdup_printf ("data:%s;base64,%s", image_type, image_data); @@ -2080,6 +2077,9 @@ get_file_content_as_base64 (const char *path) g_free (image_raw); g_free (image_data); + g_object_unref (file); + g_object_unref (file_info); + return image64; } -- cgit v1.2.3