automount: fix queue iteration

okaestne · okaestne · commit efbb81ba99e5 · 2025-11-30T17:06:13.000+01:00
fix use-after-free bug caused by dereferencing l after g_list_remove.

This change also fixes auto-mounting multiple volumes that were
connected while the screensaver was active.
diff --git a/plugins/automount/csd-automount-manager.c b/plugins/automount/csd-automount-manager.c
@@ -190,7 +190,7 @@ check_volume_queue (CsdAutomountManager *manager)
                         g_list_remove (manager->priv->volume_queue, volume);
 
                 g_object_unref (volume);
-                l = l->next;
+                l = manager->priv->volume_queue;
         }
 
         manager->priv->volume_queue = NULL;

Original file line number	Diff line number	Diff line change
`@@ -190,7 +190,7 @@ check_volume_queue (CsdAutomountManager *manager)`
`190`	`190`	`g_list_remove (manager->priv->volume_queue, volume);`
`191`	`191`
`192`	`192`	`g_object_unref (volume);`
`193`		`- l = l->next;`
	`193`	`+ l = manager->priv->volume_queue;`
`194`	`194`	`}`
`195`	`195`
`196`	`196`	`manager->priv->volume_queue = NULL;`