[Spice-commits] 2 commits - gtk/spice-session.c gtk/usb-device-widget.c spice-common

[Marc-André Lureau]

 gtk/spice-session.c     |    5 +++--
 gtk/usb-device-widget.c |    3 +++
 spice-common            |    2 +-
 3 files changed, 7 insertions(+), 3 deletions(-)

New commits:
commit 9f7c12da84d63280767ba7175043bcb29404458d
Author: Marc-André Lureau <marcandre.lureau at redhat.com>
Date:   Thu Mar 29 21:30:45 2012 +0200

    session: take pubkey reference in setter
    
    The session assumed it owned a reference to it.
    But it didn't get it, and that lead to invalid memory access.
    
    Fixes:  https://bugzilla.redhat.com/show_bug.cgi?id=802574

diff --git a/gtk/spice-session.c b/gtk/spice-session.c
index ea1a0f3..d30d089 100644
--- a/gtk/spice-session.c
+++ b/gtk/spice-session.c
@@ -476,7 +476,7 @@ static void spice_session_set_property(GObject      *gobject,
     case PROP_PUBKEY:
         if (s->pubkey)
             g_byte_array_unref(s->pubkey);
-        s->pubkey = g_value_get_boxed(value);
+        s->pubkey = g_value_dup_boxed(value);
         if (s->pubkey)
             s->verify = SPICE_SESSION_VERIFY_PUBKEY;
 	break;
diff --git a/spice-common b/spice-common
index fb24e4e..e3f6941 160000
--- a/spice-common
+++ b/spice-common
@@ -1 +1 @@
-Subproject commit fb24e4e28bad0b0e2bb670deb9fb56223be49ada
+Subproject commit e3f6941895085c7138abcb49a98572ea1479ac1a
commit 23224b116e3273608641e880d812e46defd843e1
Author: Marc-André Lureau <marcandre.lureau at redhat.com>
Date:   Thu Mar 29 19:12:11 2012 +0200

    Be more tolerant on NULL arrays
    
    2 places where we should be more carreful with NULL arrays, and we can
    avoid potential crashes.

diff --git a/gtk/spice-session.c b/gtk/spice-session.c
index e9c8b94..ea1a0f3 100644
--- a/gtk/spice-session.c
+++ b/gtk/spice-session.c
@@ -474,7 +474,8 @@ static void spice_session_set_property(GObject      *gobject,
         s->client_provided_sockets = g_value_get_boolean(value);
         break;
     case PROP_PUBKEY:
-        g_byte_array_unref(s->pubkey);
+        if (s->pubkey)
+            g_byte_array_unref(s->pubkey);
         s->pubkey = g_value_get_boxed(value);
         if (s->pubkey)
             s->verify = SPICE_SESSION_VERIFY_PUBKEY;
diff --git a/gtk/usb-device-widget.c b/gtk/usb-device-widget.c
index bad36b2..3ed81e4 100644
--- a/gtk/usb-device-widget.c
+++ b/gtk/usb-device-widget.c
@@ -219,12 +219,15 @@ static GObject *spice_usb_device_widget_constructor(
                      G_CALLBACK(device_error_cb), self);
 
     devices = spice_usb_device_manager_get_devices(priv->manager);
+    if (!devices)
+        goto end;
 
     for (i = 0; i < devices->len; i++)
         device_added_cb(NULL, g_ptr_array_index(devices, i), self);
 
     g_ptr_array_unref(devices);
 
+end:
     return obj;
 }