#1 Changes...
Merged 5 years ago by kalev. Opened 5 years ago by kathenas.
Unknown source master  into  master

@@ -1,170 +0,0 @@

- From a74c782c774d5e320160ba72f840f51103d887ba Mon Sep 17 00:00:00 2001

- From: Marcus Lundblad <ml@update.uu.se>

- Date: Fri, 19 Oct 2018 12:28:54 +0200

- Subject: [PATCH] overpass, placeBubble: Avoid use-after-free

- 

- Use bound properties to avoid JS accessing finalized GObject.

- 

- Fixes #134

- ---

-  src/overpass.js    | 28 ++++++++++++++++++++--------

-  src/placeBubble.js | 40 +++++++++++++++++++++++++++++-----------

-  2 files changed, 49 insertions(+), 19 deletions(-)

- 

- diff --git a/src/overpass.js b/src/overpass.js

- index b8307ca676b2..cf5cba37f3c0 100644

- --- a/src/overpass.js

- +++ b/src/overpass.js

- @@ -19,6 +19,7 @@

-  

-  const Format = imports.format;

-  const Geocode = imports.gi.GeocodeGlib;

- +const GObject = imports.gi.GObject;

-  const Soup = imports.gi.Soup;

-  

-  const Place = imports.place;

- @@ -33,11 +34,22 @@ const _DEFAULT_OUTPUT_SORT_ORDER = 'qt';

-  

-  const BASE_URL = 'https://overpass-api.de/api/interpreter';

-  

- -var Overpass = class Overpass {

- +var Overpass = GObject.registerClass({

- +    Properties: {

- +        'place': GObject.ParamSpec.object('place',

- +                                          'Place',

- +                                          'Place with added information',

- +                                          GObject.ParamFlags.READABLE |

- +                                          GObject.ParamFlags.WRITABLE,

- +                                          Geocode.Place)

- +    }

- +}, class Overpass extends GObject.Object {

-  

- -    constructor(params) {

- +    _init(params) {

-          params = params || { };

-  

- +        super._init();

- +

-          // maximum allowed runtime for the query in seconds

-          this.timeout = params.timeout || _DEFAULT_TIMEOUT;

-  

- @@ -60,7 +72,7 @@ var Overpass = class Overpass {

-          this._session = new Soup.Session();

-      }

-  

- -    addInfo(place, callback) {

- +    addInfo(place) {

-          let url = this._getQueryUrl(place);

-          let uri = new Soup.URI(url);

-          let request = new Soup.Message({ method: 'GET',

- @@ -68,16 +80,16 @@ var Overpass = class Overpass {

-  

-          this._session.queue_message(request, (obj, message) => {

-              if (message.status_code !== Soup.KnownStatusCode.OK) {

- -                callback(false, message.status_code, null);

- +                Utils.debug('Failed to fetch Overpass result: ' + message.status_code);

-                  return;

-              }

-              try {

-                  let jsonObj = JSON.parse(message.response_body.data);

-                  this._populatePlace(place, jsonObj);

- -                callback(true,

- -                         message.status_code);

- +                this.place = place;

- +                this.notify('place');

-              } catch(e) {

- -                callback(false, message.status_code);

- +                Utils.debug('Failed to parse Overpass result');

-              }

-          });

-      }

- @@ -143,4 +155,4 @@ var Overpass = class Overpass {

-                                                  this.outputSortOrder,

-                                                  this.outputCount ]);

-      }

- -};

- +});

- diff --git a/src/placeBubble.js b/src/placeBubble.js

- index 1bdf47d5ca6a..720fbbb5220e 100644

- --- a/src/placeBubble.js

- +++ b/src/placeBubble.js

- @@ -20,6 +20,7 @@

-   */

-  

-  const GdkPixbuf = imports.gi.GdkPixbuf;

- +const Geocode = imports.gi.GeocodeGlib;

-  const GLib = imports.gi.GLib;

-  const GObject = imports.gi.GObject;

-  const Gtk = imports.gi.Gtk;

- @@ -43,8 +44,16 @@ const THUMBNAIL_FETCH_SIZE = 128;

-  // final scaled size of cropped thumnail

-  const THUMBNAIL_FINAL_SIZE = 70;

-  

- -var PlaceBubble = GObject.registerClass(

- -class PlaceBubble extends MapBubble.MapBubble {

- +var PlaceBubble = GObject.registerClass({

- +    Properties: {

- +        'overpass-place': GObject.ParamSpec.object('overpass-place',

- +                                                   'Overpass Place',

- +                                                   'The place as filled in by Overpass',

- +                                                   GObject.ParamFlags.READABLE |

- +                                                   GObject.ParamFlags.WRITABLE,

- +                                                   Geocode.Place)

- +    }

- +}, class PlaceBubble extends MapBubble.MapBubble {

-  

-      _init(params) {

-          let ui = Utils.getUIObject('place-bubble', [ 'stack',

- @@ -75,24 +84,25 @@ class PlaceBubble extends MapBubble.MapBubble {

-          this._revealer = ui.contentRevealer;

-  

-          let overpass = new Overpass.Overpass();

- +

- +        /* use a property binding from the Overpass instance to avoid

- +         * accessing accessing this object after the underlying GObject has

- +         * been finalized */

- +        overpass.bind_property('place', this, 'overpass-place',

- +                               GObject.BindingFlags.DEFAULT);

- +        this.connect('notify::overpass-place', () => this._onInfoAdded());

- +

-          if (Application.placeStore.exists(this.place, null)) {

-  

-              // If the place is stale, update from Overpass.

-              if (Application.placeStore.isStale(this.place)) {

- -                overpass.addInfo(this.place, (status, code) => {

- -                    this._populate(this.place);

- -                    Application.placeStore.updatePlace(this.place);

- -                });

- +                overpass.addInfo(this.place);

-              } else {

-                  let place = Application.placeStore.get(this.place);

-                  this._populate(place);

-              }

-          } else if (this.place.store) {

- -            overpass.addInfo(this.place, (status, code) => {

- -                this._populate(this.place);

- -                Application.placeStore.addPlace(this.place,

- -                                                PlaceStore.PlaceType.RECENT);

- -            });

- +            overpass.addInfo(this.place);

-          } else {

-              this._populate(this.place);

-          }

- @@ -107,6 +117,14 @@ class PlaceBubble extends MapBubble.MapBubble {

-          this._initExpandButton();

-      }

-  

- +    _onInfoAdded() {

- +        this._populate(this.place);

- +        if (Application.placeStore.exists(this.place, null))

- +            Application.placeStore.updatePlace(this.place);

- +        else

- +            Application.placeStore.addPlace(this.place, PlaceStore.PlaceType.RECENT);

- +    }

- +

-      _formatWikiLink(wiki) {

-          let lang = Wikipedia.getLanguage(wiki);

-          let article = Wikipedia.getArticle(wiki);

- -- 

- 2.14.4

- 

file modified
+4 -4
@@ -2,7 +2,7 @@

  %global champlain_version 0.12.14

  

  Name:           gnome-maps

- Version:        3.31.1

+ Version:        3.31.3

  Release:        1%{?dist}

  Summary:        Map application for GNOME

  
@@ -10,8 +10,6 @@

  URL:            https://wiki.gnome.org/Apps/Maps

  Source0:        https://download.gnome.org/sources/%{name}/3.31/%{name}-%{version}.tar.xz

  

- # https://bugzilla.redhat.com/show_bug.cgi?id=1633133

- Patch0:         gnome-maps-overpass-placeBubble-Avoid-use-after-free.patch

  

  BuildRequires:  gettext

  BuildRequires:  meson
@@ -42,7 +40,6 @@

  

  %prep

  %setup -q

- %patch0 -p1

  

  

  %build
@@ -77,6 +74,9 @@

  %{_libdir}/%{name}/

  

  %changelog

+ * Wed Dec 12 2018 Phil Wyett <philwyett@kathenas.org> - 3.31.3-1

+ - Update to 3.31.3

+ 

  * Mon Oct 22 2018 Debarshi Ray <rishi@fedoraproject.org> - 3.31.1-1

  - Update to 3.31.1

  

  • Update to 3.31.3.
  • Drop 'gnome-maps-overpass-placeBubble-Avoid-use-after-free.patch'.

Pull-Request has been merged by kalev

5 years ago