[gnome-desktop3] - Fix a possible double-free crasher

[Bastien Nocera]

commit 752dc9e4b159519726ac088a1f8bb7ddf40afaa2
Author: Bastien Nocera <hadess at hadess.net>
Date:   Thu Nov 11 14:01:09 2010 +0000

    - Fix a possible double-free crasher

 ...e-double-free-when-destroying-private-win.patch |   38 ++++++++++++++++
 cairo-drawing.patch                                |   46 --------------------
 display-cleanup.patch                              |   20 ---------
 gnome-desktop3.spec                                |    9 +++-
 4 files changed, 46 insertions(+), 67 deletions(-)
---
diff --git a/0001-Fix-possible-double-free-when-destroying-private-win.patch b/0001-Fix-possible-double-free-when-destroying-private-win.patch
new file mode 100644
index 0000000..405bc96
--- /dev/null
+++ b/0001-Fix-possible-double-free-when-destroying-private-win.patch
@@ -0,0 +1,38 @@
+From 7e967de7dff160d7302b1ab66db3f9054b8373b3 Mon Sep 17 00:00:00 2001
+From: Bastien Nocera <hadess at hadess.net>
+Date: Thu, 11 Nov 2010 13:21:21 +0000
+Subject: [PATCH] Fix possible double-free when destroying private windows
+
+This could cause free'ing random data when the members of ->windows
+were destroyed, but ->windows itself wasn't. As it was != NULL, we'd
+be free memory that wouldn't belong to us anymore.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=634534
+---
+ libgnome-desktop/gnome-rr-labeler.c |    5 +++++
+ 1 files changed, 5 insertions(+), 0 deletions(-)
+
+diff --git a/libgnome-desktop/gnome-rr-labeler.c b/libgnome-desktop/gnome-rr-labeler.c
+index 1de4569..ebf9905 100644
+--- a/libgnome-desktop/gnome-rr-labeler.c
++++ b/libgnome-desktop/gnome-rr-labeler.c
+@@ -411,11 +411,16 @@ gnome_rr_labeler_hide (GnomeRRLabeler *labeler)
+ 
+ 	g_return_if_fail (GNOME_IS_RR_LABELER (labeler));
+ 
++	if (labeler->windows == NULL)
++		return;
++
+ 	for (i = 0; i < labeler->num_outputs; i++)
+ 		if (labeler->windows[i] != NULL) {
+ 			gtk_widget_destroy (labeler->windows[i]);
+ 			labeler->windows[i] = NULL;
+ 		}
++	g_free (labeler->windows);
++	labeler->windows = NULL;
+ }
+ 
+ void
+-- 
+1.7.3.2
+
diff --git a/gnome-desktop3.spec b/gnome-desktop3.spec
index ad18c9b..a0646c9 100644
--- a/gnome-desktop3.spec
+++ b/gnome-desktop3.spec
@@ -9,7 +9,7 @@
 Summary: Shared code among gnome-panel, gnome-session, nautilus, etc
 Name: gnome-desktop3
 Version: 2.91.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 URL: http://www.gnome.org
 Source0: http://download.gnome.org/sources/gnome-desktop/2.91/gnome-desktop-%{version}.tar.bz2
 License: GPLv2+ and LGPLv2+
@@ -36,6 +36,9 @@ BuildRequires: gettext
 BuildRequires: gtk-doc >= %{gtk_doc_version}
 BuildRequires: automake autoconf libtool intltool
 
+# Upstream patch
+Patch0: 0001-Fix-possible-double-free-when-destroying-private-win.patch
+
 %description
 
 The gnome-desktop package contains an internal library
@@ -63,6 +66,7 @@ libgnomedesktop.
 
 %prep
 %setup -q -n gnome-desktop-%{version}
+%patch0 -p1 -b .double-free
 
 %build
 %configure --with-gnome-distributor="Red Hat, Inc" \
@@ -110,6 +114,9 @@ rm -f $RPM_BUILD_ROOT%{_mandir}/man1/gnome-about*
 %doc %{_datadir}/gtk-doc/html/gnome-desktop3/
 
 %changelog
+* Thu Nov 11 2010 Bastien Nocera <bnocera at redhat.com> 2.91.1-2
+- Fix a possible double-free crasher
+
 * Wed Nov 10 2010 Bastien Nocera <bnocera at redhat.com> 2.91.1-1
 - Update to 2.91.1