summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDmitry Osipenko <digetx@gmail.com>2017-01-20 15:38:41 (GMT)
committerJan Grulich <jgrulich@redhat.com>2017-01-23 11:44:26 (GMT)
commita19794a3efd4642a9475753bef034a3f5ee6602b (patch)
treeca602d28d033bfdba71509861a5c0bcd7064fbb1
parent30226c538ff9b0c1e353a9303b873548ca3dfbff (diff)
Fix crash caused by notifications use-after-free
The KNotification could be deferenced on sendEvent(), so additional checks are required.
-rw-r--r--kded/notification.cpp16
1 files changed, 12 insertions, 4 deletions
diff --git a/kded/notification.cpp b/kded/notification.cpp
index daf9be8..4612073 100644
--- a/kded/notification.cpp
+++ b/kded/notification.cpp
@@ -344,7 +344,9 @@ void Notification::stateChanged(NetworkManager::Device::State newstate, NetworkM
notify->setTitle(identifier);
notify->setText(text);
notify->sendEvent();
- m_notifications[device->uni()] = notify;
+ if (notify->id() != -1) {
+ m_notifications[device->uni()] = notify;
+ }
}
}
@@ -457,7 +459,9 @@ void Notification::onActiveConnectionStateChanged(NetworkManager::ActiveConnecti
notify->setTitle(acName);
notify->setText(text);
notify->sendEvent();
- m_notifications[connectionId] = notify;
+ if (notify->id() != -1) {
+ m_notifications[connectionId] = notify;
+ }
}
void Notification::onVpnConnectionStateChanged(NetworkManager::VpnConnection::State state, NetworkManager::VpnConnection::StateChangeReason reason)
@@ -531,7 +535,9 @@ void Notification::onVpnConnectionStateChanged(NetworkManager::VpnConnection::St
notify->setTitle(vpnName);
notify->setText(text);
notify->sendEvent();
- m_notifications[connectionId] = notify;
+ if (notify->id() != -1) {
+ m_notifications[connectionId] = notify;
+ }
}
void Notification::notificationClosed()
@@ -598,5 +604,7 @@ void Notification::onCheckActiveConnectionOnResume()
notify->setTitle(i18n("No Network Connection"));
notify->setText(i18n("You are no longer connected to a network."));
notify->sendEvent();
- m_notifications[uni] = notify;
+ if (notify->id() != -1) {
+ m_notifications[uni] = notify;
+ }
}