Fix use after free when returned objects hold only one ref
authorMilan Crha <mcrha@redhat.com>
Mon, 8 May 2017 22:21:58 +0000 (17:21 -0500)
committerMike Gorse <mgorse@suse.com>
Mon, 8 May 2017 22:21:58 +0000 (17:21 -0500)
commit8d3cc68f7bc62c7015d986212be0d5d776920ee2
treec5d62c4c0a7db3e536d9a52b0f125eb03265365d
parente0ce9bf054f620dd717870ab21fdfaebec1dab8d
Fix use after free when returned objects hold only one ref

It seems that not all code expects atk_object_ref_accessible_child()
returning NULL, neither that it can return an object with only one
reference, thus the following unref in the code can cause use-after-free
eventually.

At least the chunk in impl_GetChildAtIndex() avoids runtime warning about
invalid object being passed to g_object_unref(), which happened, in this
case, when evolution returned NULL. Evolution returns objects with one
reference only often, which tries to address the other chunks here.

https://bugzilla.gnome.org/show_bug.cgi?id=781716
atk-adaptor/adaptors/accessible-adaptor.c
atk-adaptor/adaptors/collection-adaptor.c