Branch: refs/heads/master Author: Thomas Martitz thomas.martitz@student.htw-berlin.de Committer: Thomas Martitz thomas.martitz@student.htw-berlin.de Date: Wed, 23 Oct 2013 18:46:03 UTC Commit: 08a1487fb3e271b3c508e14b9d8f64d851e8a80a https://github.com/geany/geany-plugins/commit/08a1487fb3e271b3c508e14b9d8f64...

Log Message: ----------- autoclose: Fix crash due to use-after-free.

The signal handler for "sci-notify" needs to be disconnected when the document is closed because the handler might be called afterwards but with already freed user data.

Modified Paths: -------------- autoclose/src/autoclose.c

Modified: autoclose/src/autoclose.c 11 files changed, 6 insertions(+), 5 deletions(-) =================================================================== @@ -802,11 +802,10 @@ struct_semicolon( on_document_activate(GObject *obj, GeanyDocument *doc, gpointer user_data) { AutocloseUserData *data; - ScintillaObject *sci = NULL; - g_return_if_fail(NULL != doc && NULL != doc->editor); - sci = doc->editor->sci; - g_return_if_fail(NULL != sci); + ScintillaObject *sci; + g_return_if_fail(DOC_VALID(doc));

+ sci = doc->editor->sci; data = g_new0(AutocloseUserData, 1); data->doc = doc; plugin_signal_connect(geany_plugin, G_OBJECT(sci), "sci-notify", @@ -820,9 +819,11 @@ struct_semicolon( static void on_document_close(GObject *obj, GeanyDocument *doc, gpointer user_data) { - /* free the AutocloseUserData instance */ + /* free the AutocloseUserData instance and disconnect the handler */ ScintillaObject *sci = doc->editor->sci; AutocloseUserData *data = g_object_steal_data(G_OBJECT(sci), AC_GOBJECT_KEY); + /* no plugin_signal_disconnect() ?? */ + g_signal_handlers_disconnect_by_func(G_OBJECT(sci), G_CALLBACK(on_editor_notify), data); g_free(data); }

-------------- This E-Mail was brought to you by github_commit_mail.py (Source: https://github.com/geany/infrastructure).