[Wayland-bugs] [Bug 61385] New: wayland-client.c:dispatch_event() dereferences proxy after free

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=61385

          Priority: medium
            Bug ID: 61385
          Assignee: wayland-bugs at lists.freedesktop.org
           Summary: wayland-client.c:dispatch_event() dereferences proxy
                    after free
          Severity: normal
    Classification: Unclassified
                OS: All
          Reporter: heroor at gmail.com
          Hardware: Other
            Status: NEW
           Version: unspecified
         Component: wayland
           Product: Wayland

Created attachment 75438
  --> https://bugs.freedesktop.org/attachment.cgi?id=75438&action=edit
clang-analyzer output

In dispatch_event(), we call free(proxy) but if proxy_destroyed is false then
the function does not return but continues further by accessing
proxy->object.implementation.

Caught this by running clang-analyzer on wayland. See attachment.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/wayland-bugs/attachments/20130224/c43d63df/attachment.html>