Bug #620234 - Invalid writes during free/busy

2 files changed, 38 insertions, 6 deletions

diff --git a/calendar/gui/e-meeting-list-view.c b/calendar/gui/e-meeting-list-view.c
index 8d233cf1ef..f3c5cb8b49 100644
--- a/calendar/gui/e-meeting-list-view.c
+++ b/calendar/gui/e-meeting-list-view.c
@@ -402,7 +402,7 @@ attendee_edited_cb (GtkCellRenderer *renderer, const gchar *path, GList *address
 			}
 		} else {
 			gboolean address_changed = FALSE;
-			EMeetingAttendee *attendee = e_meeting_store_add_attendee_with_defaults (model);
+			EMeetingAttendee *attendee;
 
 			if (existing_attendee) {
 				const gchar *addr = e_meeting_attendee_get_address (existing_attendee);
@@ -413,7 +413,9 @@ attendee_edited_cb (GtkCellRenderer *renderer, const gchar *path, GList *address
 				address_changed = addr && g_ascii_strcasecmp (addr, email) != 0;
 
 				e_meeting_list_view_remove_attendee_from_name_selector (E_MEETING_LIST_VIEW (view), existing_attendee);
-				e_meeting_store_remove_attendee (model, existing_attendee);
+				attendee = existing_attendee;
+			} else {
+				attendee = e_meeting_store_add_attendee_with_defaults (model);
 			}
 
 			value_edited (view, E_MEETING_STORE_ADDRESS_COL, path, email);
@@ -425,7 +427,7 @@ attendee_edited_cb (GtkCellRenderer *renderer, const gchar *path, GList *address
 			e_meeting_list_view_add_attendee_to_name_selector (E_MEETING_LIST_VIEW (view), attendee);
 
 			if (address_changed)
-				e_meeting_attendee_set_status (existing_attendee, ICAL_PARTSTAT_NEEDSACTION);
+				e_meeting_attendee_set_status (attendee, ICAL_PARTSTAT_NEEDSACTION);
 
 			g_signal_emit_by_name (G_OBJECT (view), "attendee_added", (gpointer) attendee);
 		}
diff --git a/calendar/gui/e-meeting-store.c b/calendar/gui/e-meeting-store.c
index 4893728a45..db7648d8f1 100644
--- a/calendar/gui/e-meeting-store.c
+++ b/calendar/gui/e-meeting-store.c
@@ -548,6 +548,25 @@ e_meeting_store_set_value (EMeetingStore *store, gint row, gint col, const gchar
 	}
 }
 
+struct FindAttendeeData
+{
+	EMeetingAttendee *find;
+	EMeetingStoreQueueData *qdata;
+};
+
+static void
+find_attendee_cb (gpointer key, gpointer value, gpointer user_data)
+{
+	EMeetingStoreQueueData *qdata = value;
+	struct FindAttendeeData *fad = user_data;
+
+	g_return_if_fail (qdata != NULL);
+	g_return_if_fail (fad != NULL);
+
+	if (qdata->attendee == fad->find)
+		fad->qdata = qdata;
+}
+
 static void
 refresh_queue_remove (EMeetingStore *store, EMeetingAttendee *attendee)
 {
@@ -560,6 +579,17 @@ refresh_queue_remove (EMeetingStore *store, EMeetingAttendee *attendee)
 	qdata = g_hash_table_lookup (
 		priv->refresh_data, itip_strip_mailto (
 		e_meeting_attendee_get_address (attendee)));
+	if (!qdata) {
+		struct FindAttendeeData fad = { 0 };
+
+		fad.find = attendee;
+		fad.qdata = NULL;
+
+		g_hash_table_foreach (priv->refresh_data, find_attendee_cb, &fad);
+
+		qdata = fad.qdata;
+	}
+
 	if (qdata) {
 		g_mutex_lock (priv->mutex);
 		g_hash_table_remove (
@@ -793,7 +823,7 @@ e_meeting_store_init (EMeetingStore *store)
 
 	store->priv->attendees = g_ptr_array_new ();
 	store->priv->refresh_queue = g_ptr_array_new ();
-	store->priv->refresh_data = g_hash_table_new (g_str_hash, g_str_equal);
+	store->priv->refresh_data = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL);
 
 	store->priv->mutex = g_mutex_new ();
 
@@ -1615,8 +1645,8 @@ refresh_queue_add (EMeetingStore *store, gint row,
 		g_ptr_array_add (qdata->data, data);
 
 		g_hash_table_insert (
-			priv->refresh_data, (gpointer) itip_strip_mailto (
-			e_meeting_attendee_get_address (attendee)), qdata);
+			priv->refresh_data, g_strdup (itip_strip_mailto (
+			e_meeting_attendee_get_address (attendee))), qdata);
 	} else {
 		if (e_meeting_time_compare_times (start, &qdata->start) == -1)
 			qdata->start = *start;