[telepathy-glib/master] TpConnectionManager: weak-unref user object when freeing WhenReadyContext

[Simon McVittie]

This fixes a use-after-free followed by an assertion failure, if the
user-supplied object is destroyed after the WhenReadyContext completes.
---
 telepathy-glib/connection-manager.c |    8 ++++++++
 1 files changed, 8 insertions(+), 0 deletions(-)

diff --git a/telepathy-glib/connection-manager.c b/telepathy-glib/connection-manager.c
index 0ff3305..551213c 100644
--- a/telepathy-glib/connection-manager.c
+++ b/telepathy-glib/connection-manager.c
@@ -225,11 +225,19 @@ typedef struct {
     GObject *weak_object;
 } WhenReadyContext;
 
+static void when_ready_context_cancel (gpointer d, GObject *corpse);
+
 static void
 when_ready_context_free (gpointer d)
 {
   WhenReadyContext *c = d;
 
+  if (c->weak_object != NULL)
+    {
+      g_object_weak_unref (c->weak_object, when_ready_context_cancel, c);
+      c->weak_object = NULL;
+    }
+
   if (c->cm != NULL)
     {
       g_object_unref (c->cm);
-- 
1.5.6.5