gtkmountoperation: avoid SEGV after bad password input
authorMartin Wilck <mwilck@suse.com>
Fri, 2 Jun 2023 13:16:58 +0000 (15:16 +0200)
committerSimon McVittie <smcv@debian.org>
Sun, 10 Sep 2023 14:51:04 +0000 (15:51 +0100)
commit51e803b03cd54e44094260af0e268148a1486eb6
tree5a05bd627e4ba99d77f776ae111be7a93a33ce5a
parenta0a7d99d780803118b09a49898c422dcc2e791f0
gtkmountoperation: avoid SEGV after bad password input

I observed the following nautilus crash below after trying to access an SMB
share and mistyping my password (it also happens if mounting the SMB share
fails for other reasons after entering a password). The crash happens when
the password entry window pops up the second time, in this code path, at
the 7th element of priv->user_widgets:

458 pw_dialog_anonymous_toggled (GtkWidget         *widget,
459                              GtkMountOperation *operation)
460 {
...
472   for (l = priv->user_widgets; l != NULL; l = l->next)
473     {
474       gtk_widget_set_sensitive (GTK_WIDGET (l->data), !priv->anonymous);
475     }

The broken element had l->data = 0xaaaaaaaaaaaa, which means the pointer had
been freed.

The broken list entries were at the of the list because when
gtk_mount_operation_ask_password_do_gtk() constucts the pop-up the 2nd time,
it prepends new widgets:

gtk_mount_operation_ask_password_do_gtk()
   table_add_entry
       operation->priv->user_widgets = g_list_prepend (operation->priv->user_widgets, entry);

The problem is that in pw_dialog_got_response(), the widget is destroyed,
which also destroys all child widgets, but the priv->user_widgets list is
neither freed nor set to NULL.

Fix it.

Forwarded: https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/6049
Origin: 3.24.39, commit:1d95b8ab2646b3e36a1c1b23b771c4f145be13fc

Gbp-Pq: Name gtkmountoperation-avoid-SEGV-after-bad-password-input.patch
gtk/gtkmountoperation.c