Skip to content

Use-after-free in gsocketclient.c:connection_attempt_remove()

While testing some other things in gnome-software, valgrind claimed a use-after-free with glib2-2.79.1-1.fc40.x86_64:

 Invalid read of size 8
    at 0x4A6E351: connection_attempt_remove (gsocketclient.c:1593)
    by 0x4A703E0: g_socket_client_connected_callback (gsocketclient.c:1935)
    by 0x4A7582B: g_task_return_now (gtask.c:1361)
    by 0x4A75864: complete_in_idle_cb (gtask.c:1375)
    by 0x4C5598C: g_idle_dispatch (gmain.c:6150)
    by 0x4C4F26B: UnknownInlinedFun (gmain.c:3344)
    by 0x4C4F26B: g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4152)
    by 0x4CB02A7: g_main_context_iterate_unlocked.isra.0 (gmain.c:4217)
    by 0x4C506E2: g_main_context_iteration (gmain.c:4282)
    by 0x4AAB37C: g_application_run (gapplication.c:2613)
    by 0x134527: main (gs-main.c:49)
  Address 0x3109b378 is 56 bytes inside a block of size 96 free'd
    at 0x4845B2C: free (vg_replace_malloc.c:985)
    by 0x4C50074: g_free_sized (gmem.c:238)
    by 0x4C7251D: g_slice_free1 (gslice.c:277)
    by 0x4A78EB0: g_task_finalize (gtask.c:763)
    by 0x4BB5283: g_object_unref (gobject.c:4100)
    by 0x4A703D8: g_socket_client_connected_callback (gsocketclient.c:1934)
    by 0x4A7582B: g_task_return_now (gtask.c:1361)
    by 0x4A75864: complete_in_idle_cb (gtask.c:1375)
    by 0x4C5598C: g_idle_dispatch (gmain.c:6150)
    by 0x4C4F26B: UnknownInlinedFun (gmain.c:3344)
    by 0x4C4F26B: g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4152)
    by 0x4CB02A7: g_main_context_iterate_unlocked.isra.0 (gmain.c:4217)
    by 0x4C506E2: g_main_context_iteration (gmain.c:4282)
  Block was alloc'd at
    at 0x484280F: malloc (vg_replace_malloc.c:442)
    by 0x4C55B69: g_malloc (gmem.c:100)
    by 0x4C6ECA4: g_slice_alloc (gslice.c:193)
    by 0x4A6EE9C: g_socket_client_connect_async (gsocketclient.c:2152)
    by 0x59D0912: ??? (in /usr/lib64/libsoup-3.0.so.0.7.1)
    by 0x59E899F: ??? (in /usr/lib64/libsoup-3.0.so.0.7.1)
    by 0x59E8B91: ??? (in /usr/lib64/libsoup-3.0.so.0.7.1)
    by 0x4A7582B: g_task_return_now (gtask.c:1361)
    by 0x4A794C2: UnknownInlinedFun (gtask.c:1430)
    by 0x4A794C2: g_task_return (gtask.c:1387)
    by 0x59D1877: ??? (in /usr/lib64/libsoup-3.0.so.0.7.1)
    by 0x4A7582B: g_task_return_now (gtask.c:1361)
    by 0x4A794C2: UnknownInlinedFun (gtask.c:1430)
    by 0x4A794C2: g_task_return (gtask.c:1387)