Bug#658113: glib/gio/gsettingsbackend: segfault in g_settings_backend()

[Simon McVittie]

tags 658113 = moreinfo
retitle 658113 segfault in g_settings_backend_unsubscribe(NULL, ...)
thanks

On Tue, 31 Jan 2012 at 13:46:26 +0100, Andrew O. Shadura wrote:
> g_settings_backend() doesn't check if backend is non-NULL before
> dereferencing the pointer.

I'm pretty sure that's not something that's meant to work. GLib functions
that are documented to take a SomeObject * argument, particularly the
first argument to methods (analogous to "this" in C++/"self" in Python),
typically consider it to be programmer error (undefined behaviour) to pass
NULL for that argument.

If anything semi-graceful is done about this, the GLib convention would be:

    void
    g_settings_backend_unsubscribe (GSettingsBackend *backend, ...)
    {
      g_return_if_fail (G_IS_SETTINGS_BACKEND (backend));
      ...
    }

which is still covered by "undefined behaviour" but somewhat less crashy
(it normally prints a "critical warning" to stderr, but can be made to
abort via an environment variable), and makes an attempt to deal with
dangling pointers as well as NULL. However, g_settings_backend_unsubscribe()
is documented to be internal to GLib, so I can see why this wasn't done.

If some application is crashing because of this, then that's either a bug
in that application, or in some library that it uses (perhaps another part
of GLib). Do you have a backtrace for this, or a way to reproduce it?

Regards,
    S