Skip to content

Solve another possible double-free involving lcms

Simon McVittie requested to merge wip/smcv/lcms-double-free into main

  • color-device: Make sure lcms_context is not NULL

    lcms interprets a NULL context as using a default, non-thread-safe context, which is unsuitable for mutter's use. Make sure we're always using a non-trivial context.

    Helps: #2659 (closed)

  • color-device: Don't close lcms profile on error from cd_icc_load_handle

    As implemented in colord 1.4.6, cd_icc_load_handle() has three possible results:

    1. success, taking ownership of the profile;
    2. failure because cmsGetProfileContextID returns NULL, not taking ownership of the profile;
    3. failure in cd_icc_load(), taking ownership of the profile.

    The previous commit ensures that we are not in case 2.

    In case 3 where cd_icc_load() fails, ownership was already given to the colord CdIcc object, so it will be freed when the g_autoptr unrefs the CdIcc, and we must not free it again: that would be a double-free, potentially resulting in memory corruption.

    Resolves: #2659 (closed)

I do not have hardware that can reproduce this myself, so I will have to ask the reporter of bug https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1031847 to test this.

Merge request reports