And here is the patch!

Feel free to change anything, but I rebuilt locally and everything seems
to be working 100% for me. This is the exact code upstream is using, but
should be good enough until they release a new version.

thanks
From: Sean DuBois <s...@siobud.com>
Date: Thu, 04 Jan 2018 15:42:41 +0600
Subject: Fix segfault on VPN connect

Refactor in VPN applet introduced double free, this was fixed
upstream with
a52ccb2fe170558fc0aab4dd1d15ba8808b10951

Closes: #815313

Index: network-manager-applet-1.8.10/shared/nm-utils/nm-compat.c
===================================================================
--- network-manager-applet-1.8.10.orig/shared/nm-utils/nm-compat.c
+++ network-manager-applet-1.8.10/shared/nm-utils/nm-compat.c
@@ -40,30 +40,37 @@ _get_keys (NMSettingVpn *setting,
 {
 	guint len;
 	const char **keys = NULL;
-	gs_unref_ptrarray GPtrArray *a = NULL;
+	GPtrArray *a;

 	nm_assert (NM_IS_SETTING_VPN (setting));

-	a = g_ptr_array_new ();
+	if (is_secrets)
+		len = nm_setting_vpn_get_num_secrets (setting);
+	else
+		len = nm_setting_vpn_get_num_data_items (setting);
+
+	a = g_ptr_array_sized_new (len + 1);
+
 	if (is_secrets)
 		nm_setting_vpn_foreach_secret (setting, _get_keys_cb, a);
 	else
 		nm_setting_vpn_foreach_data_item (setting, _get_keys_cb, a);
-	len = a->len;

-	if (a->len) {
+	len = a->len;
+	if (len) {
 		g_ptr_array_sort (a, nm_strcmp_p);
 		g_ptr_array_add (a, NULL);
-		keys = (const char **) g_ptr_array_free (g_steal_pointer (&a), FALSE);
+		keys = g_memdup (a->pdata, a->len * sizeof (gpointer));

 		/* we need to cache the keys *somewhere*. */
 		g_object_set_qdata_full (G_OBJECT (setting),
 		                         is_secrets
 		                         ? NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_secret_keys")
 		                         : NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_data_keys"),
-		                         keys,
+		                         g_ptr_array_free (a, FALSE),
 		                         (GDestroyNotify) g_strfreev);
-	}
+	} else
+		g_ptr_array_free (a, TRUE);

 	NM_SET_OUT (out_length, len);
 	return keys;

Reply via email to