c19f4fa
From 21e5396bf5d6fe6101bb1c773632e8722fe2f3bb Mon Sep 17 00:00:00 2001
c19f4fa
From: Milan Crha <mcrha@redhat.com>
c19f4fa
Date: Mon, 31 Oct 2022 10:57:40 +0100
c19f4fa
Subject: [PATCH] event-editor: Fix possible use-after-free of recurrence until
c19f4fa
 date
c19f4fa
c19f4fa
The GcalDateSelector returns an internal instance, while the 'until' date/time
c19f4fa
is meant to be an own instance, which is freed by the GcalRecurrence instance
c19f4fa
in its free function. That means the 'until' date/time is supposed to be reffed
c19f4fa
when being assigned into the GcalRecurrence structure.
c19f4fa
c19f4fa
Closes https://gitlab.gnome.org/GNOME/gnome-calendar/-/issues/892
c19f4fa
---
c19f4fa
 src/gui/event-editor/gcal-schedule-section.c | 4 ++--
c19f4fa
 1 file changed, 2 insertions(+), 2 deletions(-)
c19f4fa
c19f4fa
diff --git a/src/gui/event-editor/gcal-schedule-section.c b/src/gui/event-editor/gcal-schedule-section.c
c19f4fa
index 2aed8e30..6a051909 100644
c19f4fa
--- a/src/gui/event-editor/gcal-schedule-section.c
c19f4fa
+++ b/src/gui/event-editor/gcal-schedule-section.c
c19f4fa
@@ -616,7 +616,7 @@ gcal_schedule_section_apply (GcalEventEditorSection *section)
c19f4fa
       recur->limit_type = gtk_combo_box_get_active (GTK_COMBO_BOX (self->repeat_duration_combo));
c19f4fa
 
c19f4fa
       if (recur->limit_type == GCAL_RECURRENCE_UNTIL)
c19f4fa
-        recur->limit.until = gcal_date_selector_get_date (GCAL_DATE_SELECTOR (self->until_date_selector));
c19f4fa
+        recur->limit.until = g_date_time_ref (gcal_date_selector_get_date (GCAL_DATE_SELECTOR (self->until_date_selector)));
c19f4fa
       else if (recur->limit_type == GCAL_RECURRENCE_COUNT)
c19f4fa
         recur->limit.count = gtk_spin_button_get_value_as_int (GTK_SPIN_BUTTON (self->number_of_occurrences_spin));
c19f4fa
 
c19f4fa
@@ -821,7 +821,7 @@ gcal_schedule_section_recurrence_changed (GcalScheduleSection *self)
c19f4fa
   recurrence->frequency = gtk_combo_box_get_active (GTK_COMBO_BOX (self->repeat_combo));
c19f4fa
   recurrence->limit_type = gtk_combo_box_get_active (GTK_COMBO_BOX (self->repeat_duration_combo));
c19f4fa
   if (recurrence->limit_type == GCAL_RECURRENCE_UNTIL)
c19f4fa
-    recurrence->limit.until = gcal_date_selector_get_date (GCAL_DATE_SELECTOR (self->until_date_selector));
c19f4fa
+    recurrence->limit.until = g_date_time_ref (gcal_date_selector_get_date (GCAL_DATE_SELECTOR (self->until_date_selector)));
c19f4fa
   else if (recurrence->limit_type == GCAL_RECURRENCE_COUNT)
c19f4fa
     recurrence->limit.count = gtk_spin_button_get_value_as_int (GTK_SPIN_BUTTON (self->number_of_occurrences_spin));
c19f4fa
 
c19f4fa
-- 
c19f4fa
GitLab
c19f4fa