Fix crash when cancelling an XMPP file transfer

Review Request #1485 — Created May 28, 2022 and submitted — Latest diff uploaded

Information

pidgin/pidgin
release-2.x.y

Reviewers

When an XMPP account has file transfers and the
connection to the XMPP server drops, the JabberStream object
gets g_free()'d, but the PurpleXfers still have pointers to it,
so when the file transfer finishes or is canceled, it tries
to remove itself from the JabberStream object and it ends up
accessing invalid memory, causing a crash.

This patch closes all file transfers associated to
a JabberStream object, right before the object gets g_free()'d.

Reliably reproduced the crash by closing internet connection while a transfer was in progress. After the patch, the crash no longer occurs because the transfers all end when the internet connection drops.

Diff Revision 1

This is not the most recent revision of the diff. The latest diff is revision 2. See what's changed.

orig
1
2

Commits

First Last Summary ID Author
Fix crash when cancelling an XMPP file transfer
When an XMPP account has file transfers and the connection to the XMPP server drops, the JabberStream object gets g_free()'d, but the PurpleXfers still have pointers to it, so when the file transfer finishes or is canceled, it tries to remove itself from the JabberStream object and it ends up accessing invalid memory, causing a crash. This patch closes all file transfers associated to a JabberStream object, right before the object gets g_free()'d.
4b0d6160d170a1bb80755402320b37993dcba7d5 Belgin Știrbu
libpurple/protocols/jabber/jabber.c
Loading...