From 892ab479ba3c4897ed3f0532413c76f30a7b91a1 Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 5 Jul 2026 10:10:10 +0200 Subject: [PATCH] group: disconnect pending reveal timeout in destructor to fix UAF With reveal-delay set, handleMouseEnter arms a Glib::signal_timeout that captures 'this'. sigc::connection's destructor does not remove the GLib source, so a Group destroyed with a pending reveal timer would fire the timeout on freed memory. Add a destructor that disconnects reveal_timeout_. --- include/group.hpp | 2 +- src/group.cpp | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/include/group.hpp b/include/group.hpp index 0e981d0d..1e2a5d55 100644 --- a/include/group.hpp +++ b/include/group.hpp @@ -14,7 +14,7 @@ class Group : public AModule { public: Group(const std::string&, const std::string&, const Json::Value&, bool); - ~Group() override = default; + ~Group() override; auto update() -> void override; operator Gtk::Widget&() override; diff --git a/src/group.cpp b/src/group.cpp index 9f11661f..5fa04884 100644 --- a/src/group.cpp +++ b/src/group.cpp @@ -105,6 +105,14 @@ Group::Group(const std::string& name, const std::string& id, const Json::Value& event_box_.add(box); } +Group::~Group() { + // Disconnect any pending reveal timeout so it cannot fire on a destroyed + // instance (the GLib source is not removed by sigc::connection's destructor). + if (reveal_timeout_.connected()) { + reveal_timeout_.disconnect(); + } +} + void Group::show_group() { box.set_state_flags(Gtk::StateFlags::STATE_FLAG_PRELIGHT); revealer.set_reveal_child(true);