[Weather Calendar] Weather info source never freed

The priv->source was allocated, but never freed, especially after
the weather backend was freed, which might cause use-after-free
in the finished_retrieval_cb() callback, when the weather backend
was freed during the data update.

This might be the cause of a crash reported at:
https://bugzilla.redhat.com/show_bug.cgi?id=1065796

diff --git a/calendar/backends/weather/e-cal-backend-weather.c b/calendar/backends/weather/e-cal-backend-weather.c
index a117f10..7a5416a 100644 (file)
--- a/calendar/backends/weather/e-cal-backend-weather.c
+++ b/calendar/backends/weather/e-cal-backend-weather.c
@@ -780,19 +780,35 @@ e_cal_backend_weather_notify_online_cb (ECalBackend *backend,
                e_cal_backend_set_writable (backend, FALSE);
 }
 
-/* Finalize handler for the weather backend */
 static void
-e_cal_backend_weather_finalize (GObject *object)
+e_cal_backend_weather_dispose (GObject *object)
 {
        ECalBackendWeatherPrivate *priv;
 
        priv = E_CAL_BACKEND_WEATHER_GET_PRIVATE (object);
 
-       if (priv->reload_timeout_id)
+       if (priv->reload_timeout_id) {
                g_source_remove (priv->reload_timeout_id);
+               priv->reload_timeout_id = 0;
+       }
 
-       if (priv->begin_retrival_id)
+       if (priv->begin_retrival_id) {
                g_source_remove (priv->begin_retrival_id);
+               priv->begin_retrival_id = 0;
+       }
+
+       g_clear_object (&priv->source);
+
+       /* Chain up to parent's dispose() method. */
+       G_OBJECT_CLASS (e_cal_backend_weather_parent_class)->dispose (object);
+}
+
+static void
+e_cal_backend_weather_finalize (GObject *object)
+{
+       ECalBackendWeatherPrivate *priv;
+
+       priv = E_CAL_BACKEND_WEATHER_GET_PRIVATE (object);
 
        if (priv->store) {
                g_object_unref (priv->store);
@@ -828,6 +844,7 @@ e_cal_backend_weather_class_init (ECalBackendWeatherClass *class)
        backend_class = (ECalBackendClass *) class;
        sync_class = (ECalBackendSyncClass *) class;
 
+       object_class->dispose = e_cal_backend_weather_dispose;
        object_class->finalize = e_cal_backend_weather_finalize;
 
        /* Execute one method at a time. */