Bug 724590 - GSlice slab_stack corruption

Dereference allocation->contention_counters before trying to take the
address of an element.

diff --git a/glib/gslice.c b/glib/gslice.c
index 0563d80..2c5f4fb 100644 (file)
--- a/glib/gslice.c
+++ b/glib/gslice.c
@@ -715,7 +715,8 @@ static ChunkLink*
 magazine_cache_pop_magazine (guint  ix,
                              gsize *countp)
 {
-  g_mutex_lock_a (&allocator->magazine_mutex, &allocator->contention_counters[ix]);
+  guint *counters = allocator->contention_counters;
+  g_mutex_lock_a (&allocator->magazine_mutex, &counters[ix]);
   if (!allocator->magazines[ix])
     {
       guint magazine_threshold = allocator_get_magazine_threshold (allocator, ix);