[evolution-exchange] Bug #601787 - Double free in destroy_oof_data

[Milan Crha <mcrha src gnome org>]

commit ba51c300c9f57dda5fd259f14ab37af430fdbafd
Author: Milan Crha <mcrha redhat com>
Date:   Mon Feb 22 21:10:23 2010 +0100

    Bug #601787 - Double free in destroy_oof_data

 eplugin/exchange-account-setup.c     |   26 ++++++++++++++------------
 eplugin/exchange-folder-permission.c |    6 ++++--
 eplugin/exchange-folder.c            |   21 ++++++++++++++++++++-
 3 files changed, 38 insertions(+), 15 deletions(-)
---
diff --git a/eplugin/exchange-account-setup.c b/eplugin/exchange-account-setup.c
index 6678e0e..879d2e8 100644
--- a/eplugin/exchange-account-setup.c
+++ b/eplugin/exchange-account-setup.c
@@ -54,7 +54,7 @@ GtkWidget* org_gnome_exchange_settings(EPlugin *epl, EConfigHookItemFactoryData
 GtkWidget *org_gnome_exchange_owa_url(EPlugin *epl, EConfigHookItemFactoryData *data);
 gboolean org_gnome_exchange_check_options(EPlugin *epl, EConfigHookPageCheckData *data);
 GtkWidget *org_gnome_exchange_auth_section (EPlugin *epl, EConfigHookItemFactoryData *data);
-void org_gnome_exchange_commit (EPlugin *epl, EConfigHookItemFactoryData *data);
+void org_gnome_exchange_commit (EPlugin *epl, EMConfigTargetAccount *target_account);
 GtkWidget* org_gnome_exchange_show_folder_size_factory (EPlugin *epl, EConfigHookItemFactoryData *data);
 
 CamelServiceAuthType camel_exchange_ntlm_authtype = {
@@ -85,7 +85,7 @@ typedef struct {
 	GtkWidget *text_view;
 }OOFData;
 
-static OOFData *oof_data;
+static OOFData *oof_data = NULL;
 
 static void
 update_state (GtkTextBuffer *buffer, gpointer data)
@@ -308,6 +308,7 @@ org_gnome_exchange_settings(EPlugin *epl, EConfigHookItemFactoryData *data)
 	gtk_text_buffer_get_bounds (buffer, &start, &end);
 	oof_message = gtk_text_buffer_get_text (buffer, &start, &end, FALSE);
 	if (oof_message && *oof_message) {
+		g_free (oof_data->message);
 		/* Will this ever happen? */
 		oof_data->message = oof_message;
 	}
@@ -862,6 +863,8 @@ set_oof_info (GtkWidget *parent)
 {
 	ExchangeAccount *account;
 
+	g_return_if_fail (oof_data != NULL);
+
 	account = exchange_operations_get_exchange_account ();
 
 	if (account && !exchange_oof_set (account, oof_data->state, oof_data->message)) {
@@ -873,21 +876,24 @@ set_oof_info (GtkWidget *parent)
 static void
 destroy_oof_data (void)
 {
-	if (oof_data->message)
+	if (oof_data && oof_data->message) {
 		g_free (oof_data->message);
-	if (oof_data)
+		oof_data->message = NULL;
+	}
+
+	if (oof_data) {
 		g_free (oof_data);
+		oof_data = NULL;
+	}
 }
 
 void
-org_gnome_exchange_commit (EPlugin *epl, EConfigHookItemFactoryData *data)
+org_gnome_exchange_commit (EPlugin *epl, EMConfigTargetAccount *target_account)
 {
-	EMConfigTargetAccount *target_account;
 	const gchar *source_url;
 	CamelURL *url;
 	gint offline_status;
 
-	target_account = (EMConfigTargetAccount *)data->config->target;
 	source_url = e_account_get_string (target_account->account,  E_ACCOUNT_SOURCE_URL);
 	if (source_url && source_url[0] != '\0')
 		url = camel_url_new (source_url, NULL);
@@ -900,10 +906,6 @@ org_gnome_exchange_commit (EPlugin *epl, EConfigHookItemFactoryData *data)
 
 		return;
 	}
-	if (data->old) {
-		camel_url_free(url);
-		return;
-	}
 
 	camel_url_free (url);
 
@@ -915,7 +917,7 @@ org_gnome_exchange_commit (EPlugin *epl, EConfigHookItemFactoryData *data)
 	}
 
 	/* Set oof data in exchange account */
-	set_oof_info (data->config->target->widget);
+	set_oof_info (target_account->target.widget);
 	destroy_oof_data ();
 	return;
 }
diff --git a/eplugin/exchange-folder-permission.c b/eplugin/exchange-folder-permission.c
index 54e28b8..bfd5e48 100644
--- a/eplugin/exchange-folder-permission.c
+++ b/eplugin/exchange-folder-permission.c
@@ -145,9 +145,11 @@ is_eex_folder_selected (EShellView *shell_view, gchar **puri)
 	}
 
 	if (res) {
-		const gchar *path;
+		const gchar *path = NULL;
+
+		if (strlen (uri) > strlen ("exchange://") + strlen (account->account_filename))
+			path = uri + strlen ("exchange://") + strlen (account->account_filename);
 
-		path = uri + strlen ("exchange://") + strlen (account->account_filename);
 		res = path && *path;
 
 		if (res) {
diff --git a/eplugin/exchange-folder.c b/eplugin/exchange-folder.c
index a92303e..6668286 100644
--- a/eplugin/exchange-folder.c
+++ b/eplugin/exchange-folder.c
@@ -80,8 +80,15 @@ exchange_get_folder (gchar *uri, CamelFolder *folder, gpointer data)
 
 	account = exchange_operations_get_exchange_account ();
 
-	if (!account)
+	if (!account) {
+		g_free (target_uri);
+		return;
+	}
+
+	if (strlen (target_uri) <= strlen ("exchange://") + strlen (account->account_filename)) {
+		g_free (target_uri);
 		return;
+	}
 
 	/* Get the subscribed folder name. */
 	name = target_uri + strlen ("exchange://") + strlen (account->account_filename);
@@ -118,6 +125,9 @@ eex_folder_inbox_unsubscribe (const gchar *uri)
 	if (!account)
 		return;
 
+	if (strlen (uri) <= strlen ("exchange://") + strlen (account->account_filename))
+		return;
+
 	target_uri = g_strdup (uri);
 	path = g_strdup (uri + strlen ("exchange://") + strlen (account->account_filename));
 	/* User will be able to unsubscribe by doing a right click on
@@ -197,6 +207,11 @@ unsubscribe_dialog_ab_response (GtkDialog *dialog, gint response, ESource *sourc
 			return;
 
 		uri = e_source_get_uri (source);
+		if (!uri || strlen (uri) <= strlen ("exchange://") + strlen (account->account_filename)) {
+			g_free (uri);
+			return;
+		}
+
 		path = g_strdup (uri + strlen ("exchange://") + strlen (account->account_filename));
 		source_uid = e_source_peek_uid (source);
 
@@ -205,6 +220,7 @@ unsubscribe_dialog_ab_response (GtkDialog *dialog, gint response, ESource *sourc
 		source_group = e_source_peek_group (source);
 		e_source_group_remove_source_by_uid (source_group, source_uid);
 		g_free (path);
+		g_free (uri);
 		gtk_widget_destroy (GTK_WIDGET (dialog));
 	}
 	if (response == GTK_RESPONSE_CANCEL)
@@ -238,6 +254,9 @@ unsubscribe_dialog_response (GtkDialog *dialog, gint response, ESource *source)
 		ruri = (gchar *) e_source_peek_relative_uri (source);
 		source_uid = e_source_peek_uid (source);
 
+		if (!ruri || strlen (ruri) <= strlen (account->account_filename))
+			return;
+
 		path = g_strdup (ruri + strlen (account->account_filename));
 		exchange_account_remove_shared_folder (account, path);
 		ids = gconf_client_get_list (client,