From 7669f5b3bc23658ac4f339fd288d8e8f9f30419e Mon Sep 17 00:00:00 2001 From: Stefan Seyfried Date: Wed, 27 Jun 2012 09:42:55 +0200 Subject: [PATCH] fix use-after-free in xfdesktop_regular_file_icon_peek_tooltip xfce_rc_close() actually free()s "comment", so it needs to come after we have strdup()ed its contents, not before. This was introduced in commit 2fac2c92 (fix for bug 8509) Fixes bug 9059. --- src/xfdesktop-regular-file-icon.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/src/xfdesktop-regular-file-icon.c b/src/xfdesktop-regular-file-icon.c index ff5d074..6e4b71d 100644 --- a/src/xfdesktop-regular-file-icon.c +++ b/src/xfdesktop-regular-file-icon.c @@ -552,6 +552,10 @@ xfdesktop_regular_file_icon_peek_tooltip(XfdesktopIcon *icon) G_FILE_ATTRIBUTE_TIME_MODIFIED); time_string = xfdesktop_file_utils_format_time_for_display(mtime); + regular_file_icon->priv->tooltip = + g_strdup_printf(_("Type: %s\nSize: %s\nLast modified: %s"), + description, size_string, time_string); + /* Extract the Comment entry from the .desktop file */ if(is_desktop_file) { @@ -563,23 +567,18 @@ xfdesktop_regular_file_icon_peek_tooltip(XfdesktopIcon *icon) xfce_rc_set_group(rcfile, "Desktop Entry"); comment = xfce_rc_read_entry(rcfile, "Comment", NULL); } + /* Prepend the comment to the tooltip */ + if(comment != NULL) { + gchar *tooltip = regular_file_icon->priv->tooltip; + regular_file_icon->priv->tooltip = g_strdup_printf("%s\n%s", + comment, + tooltip); + g_free(tooltip); + } xfce_rc_close(rcfile); } - regular_file_icon->priv->tooltip = - g_strdup_printf(_("Type: %s\nSize: %s\nLast modified: %s"), - description, size_string, time_string); - - /* Prepend the comment to the tooltip */ - if(is_desktop_file && comment != NULL) { - gchar *tooltip = regular_file_icon->priv->tooltip; - regular_file_icon->priv->tooltip = g_strdup_printf("%s\n%s", - comment, - tooltip); - g_free(tooltip); - } - g_free(time_string); g_free(size_string); g_free(description); -- 1.7.10.4