Calculate size correctly, avoid use-after-free.

2008-08-20  Colin Walters  <walters@verbum.org>

	* girepository/girmodule.c (g_ir_module_build_typelib):
	Calculate size correctly, avoid use-after-free.

svn path=/trunk/; revision=427

diff --git a/ChangeLog b/ChangeLog
index 3e06cfa..ff3bf53 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,10 @@
 2008-08-20  Colin Walters  <walters@verbum.org>
 
+       * girepository/girmodule.c (g_ir_module_build_typelib): 
+       Calculate size correctly, avoid use-after-free.
+
+2008-08-20  Colin Walters  <walters@verbum.org>
+
        * girepository/girepository.c: Remove
        g_irepository_register_file in favor of
        g_irepository_require.  There are two

diff --git a/girepository/girmodule.c b/girepository/girmodule.c
index 46e70f6..1ffbf9b 100644 (file)
--- a/girepository/girmodule.c
+++ b/girepository/girmodule.c
@@ -64,7 +64,7 @@ GTypelib *
 g_ir_module_build_typelib (GIrModule  *module,
                             GList       *modules)
 {
-  guchar *typelib;
+  GTypelib *typelib;
   gsize length;
   gint i;
   GList *e;
@@ -102,6 +102,11 @@ g_ir_module_build_typelib (GIrModule  *module,
       size += g_ir_node_get_full_size (node);
     }
 
+  /* Adjust size for strings allocated in header below specially */
+  size += strlen (module->name);
+  if (module->shared_library)
+    size += strlen (module->shared_library);
+
   g_message ("allocating %d bytes (%d header, %d directory, %d entries)\n", 
          size, header_size, dir_size, size - header_size - dir_size);
 
@@ -201,15 +206,19 @@ g_ir_module_build_typelib (GIrModule  *module,
     }
 
   dump_stats ();
-  g_hash_table_destroy (strings);
-  g_hash_table_destroy (types);
 
   header->annotations = offset2;
   
   g_message ("reallocating to %d bytes", offset2);
 
-  typelib = g_realloc (data, offset2);
+  data = g_realloc (data, offset2);
+  header = (Header*) data;
   length = header->size = offset2;
-  return g_typelib_new_from_memory (typelib, length);
+  typelib = g_typelib_new_from_memory (data, length);
+
+  g_hash_table_destroy (strings);
+  g_hash_table_destroy (types);
+
+  return typelib;
 }