New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix crash when plugin_set_key_group() is called several times by plugins #1426
Conversation
When plugin calls plugin_set_key_group() several times for the same group (when creating keybindings dynamically and needs to reset them), it crashes with the current code the second time it gets called. The reason is that group->plugin_keys is an array into which entries of group->key_items point and when calling g_ptr_array_set_size(group->key_items, 0); it calls free_key_binding() for every item - when these items are deallocated by g_free(group->plugin_keys) previously, calls of free_key_binding() reference an invalid memory. Just first resizing group->key_items (and calling free_key_binding() for its items) and freeing group->plugin_keys afterwards fixes the problem.
@kugel- have you tested this, I wouldn't even know where to start to trigger it? |
No, i haven't tested it. The change is trivial and @techee explaination makes complete sense. The first post also mentions how to trigger |
Ok, so you can test it to see if it doesn't crash for other plugins. |
@elextr No other plugin calls this function several times right now - at the moment all plugins just define their keybindings in the init function and they are done. So no existing plugin crashes. |
ok, there are two ways of looking at this:
I incline to the second view, so it nobody objects within a few days will commit it. |
Sorry, the "few" days stretched, committed |
When plugin calls plugin_set_key_group() several times for the same
group (when creating keybindings dynamically and needs to reset them),
it crashes with the current code the second time it gets called.
The reason is that group->plugin_keys is an array into which entries of
group->key_items point and when calling
g_ptr_array_set_size(group->key_items, 0);
it calls free_key_binding() for every item - when these items are
deallocated by g_free(group->plugin_keys) previously, calls of
free_key_binding() reference an invalid memory.
Just first resizing group->key_items (and calling free_key_binding() for
its items) and freeing group->plugin_keys afterwards fixes the problem.