display-settings: heap-use-after-free in on_output_event

I noticed this crash while testing multiple displays with virt-viewer and a virtual machine. (I was trying to reproduce a crash report from Red Hat's Bugzilla.)

Steps to reproduce

  • Ensure two displays are attached
  • Open Display Settings
  • In virt-viewer, resize the secondary display window a few times
    • This step triggers dimension updates on the preview canvas. I'm not sure if there's a good way to simulate similar updates on physical hardware.
  • While a resize is occurring, drag the display icon in the preview canvas area to trigger a use-after-free

Backtrace

ERROR: AddressSanitizer: heap-use-after-free on address 0x7b80d40a1fc0
READ of size 4 at 0x7b80d40a1fc0 thread T0
    #0 0x562a8adb1b53 in on_output_event xfce4-settings/dialogs/display-settings/main.c:2570:69
    #1 0x562a8adc0968 in emit_input xfce4-settings/dialogs/display-settings/scrollarea.c:739:5
    #2 0x562a8adc0968 in process_event xfce4-settings/dialogs/display-settings/scrollarea.c:791:21
    #3 0x562a8adc15e7 in process_gdk_event xfce4-settings/dialogs/display-settings/scrollarea.c:835:5
    #4 0x562a8adbe02e in foo_scroll_area_button_press xfce4-settings/dialogs/display-settings/scrollarea.c:844:5
    #5 0x7f10dc5d92c6 in _gtk_marshal_BOOLEAN__BOXEDv gtk3/builddir/gtk/gtkmarshalers.c:130:14
    #6 0x7f10d8b0aee9 in g_type_class_meta_marshalv glib/gobject/gclosure.c:1145:5
    #7 0x7f10d8b0960d in _g_closure_invoke_va glib/gobject/gclosure.c:980:7
    #8 0x7f10d8b761de in signal_emit_valist_unlocked glib/gobject/gsignal.c:3465:8
    #9 0x7f10d8b78c07 in g_signal_emit_valist glib/gobject/gsignal.c:3304:7
    #10 0x7f10d8b78c07 in g_signal_emit glib/gobject/gsignal.c:3624:3
    #11 0x7f10dd35c149 in gtk_widget_event_internal gtk3/gtk/gtkwidget.c:7827:4
    #12 0x7f10dd35bb4b in gtk_widget_event gtk3/gtk/gtkwidget.c:7397:10
    #13 0x7f10dccdc92e in propagate_event_up gtk3/gtk/gtkmain.c:2591:25
    #14 0x7f10dccdc92e in propagate_event gtk3/gtk/gtkmain.c:2694:5
    #15 0x7f10dccdb48d in gtk_propagate_event gtk3/gtk/gtkmain.c:2728:3
    #16 0x7f10dccd95b6 in gtk_main_do_event gtk3/gtk/gtkmain.c:1924:9
    #17 0x7f10daef9a99 in _gdk_event_emit gtk3/gdk/gdkevents.c:73:5
    #18 0x7f10db0c209b in gdk_event_source_dispatch gtk3/gdk/x11/gdkeventsource.c:367:7
    #19 0x7f10de361fbb in g_main_dispatch glib/glib/gmain.c:3728:27
    #20 0x7f10de361fbb in g_main_context_dispatch_unlocked glib/glib/gmain.c:4596:7
    #21 0x7f10de3631c8 in g_main_context_iterate_unlocked glib/glib/gmain.c:4665:5
    #22 0x7f10de363f04 in g_main_loop_run glib/glib/gmain.c:4870:5
    #23 0x7f10dccd8b16 in gtk_main gtk3/gtk/gtkmain.c:1332:7
    #24 0x562a8ad9e983 in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:3045:9
    #25 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
[...snip...]

0x7b80d40a1fc0 is located 0 bytes inside of 80-byte region [0x7b80d40a1fc0,0x7b80d40a2010)
freed by thread T0 here:
    #0 0x7f10de7853d1 in free
    #1 0x7f10de388c58 in g_free glib/glib/gmem.c:208:3
    #2 0x562a8ad94b01 in free_output xfce4-settings/dialogs/display-settings/display-settings.c:114:5
    #3 0x7f10de345163 in g_list_foreach glib/glib/glist.c:1008:7
    #4 0x7f10de345163 in g_list_free_full glib/glib/glist.c:162:3
    #5 0x562a8ad939cf in xfce_display_settings_set_outputs xfce4-settings/dialogs/display-settings/display-settings.c:239:5
    #6 0x562a8ad96ddf in xfce_display_settings_reload xfce4-settings/dialogs/display-settings/display-settings.c:659:9
    #7 0x562a8adc276e in screen_on_event xfce4-settings/dialogs/display-settings/display-settings-x11.c:197:5
    #8 0x7f10db0c1851 in gdk_event_apply_filters gtk3/gdk/x11/gdkeventsource.c:79:16
    #9 0x7f10db0bfd5f in gdk_event_source_translate_event gtk3/gdk/x11/gdkeventsource.c:205:16
    #10 0x7f10db0bfd5f in _gdk_x11_display_queue_events gtk3/gdk/x11/gdkeventsource.c:341:15
    #11 0x7f10daee3106 in gdk_display_get_event gtk3/gdk/gdkdisplay.c:442:5
    #12 0x7f10db0c208b in gdk_event_source_dispatch gtk3/gdk/x11/gdkeventsource.c:363:11
    #13 0x7f10de361fbb in g_main_dispatch glib/glib/gmain.c:3728:27
    #14 0x7f10de361fbb in g_main_context_dispatch_unlocked glib/glib/gmain.c:4596:7
    #15 0x7f10de3631c8 in g_main_context_iterate_unlocked glib/glib/gmain.c:4665:5
    #16 0x7f10de363f04 in g_main_loop_run glib/glib/gmain.c:4870:5
    #17 0x7f10dccd8b16 in gtk_main gtk3/gtk/gtkmain.c:1332:7
    #18 0x562a8ad9e983 in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:3045:9
    #19 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
[...snip...]

previously allocated by thread T0 here:
    #0 0x7f10de786759 in calloc
    #1 0x7f10de388baa in g_malloc0 glib/glib/gmem.c:133:13
    #2 0x562a8adc5321 in xfce_display_settings_x11_get_output xfce4-settings/dialogs/display-settings/display-settings-x11.c:457:26
    #3 0x562a8ad93a6d in xfce_display_settings_set_outputs xfce4-settings/dialogs/display-settings/display-settings.c:244:30
    #4 0x562a8ad9db2b in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:2995:9
    #5 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
    #6 0x7f10d93ecfb3 in _g_cclosure_marshal_INT__BOXED glib/gio/gmarshal-internal.c:714:14
    #7 0x7f10d8b08d5a in g_closure_invoke glib/gobject/gclosure.c:916:7
    #8 0x7f10d8b7be14 in signal_emit_unlocked_R glib/gobject/gsignal.c:3929:8
    #9 0x7f10d8b7782f in signal_emit_valist_unlocked glib/gobject/gsignal.c:3574:7
    #10 0x7f10d8b78c07 in g_signal_emit_valist glib/gobject/gsignal.c:3304:7
    #11 0x7f10d8b78c07 in g_signal_emit glib/gobject/gsignal.c:3624:3
    #12 0x7f10d9582a31 in g_application_real_local_command_line glib/gio/gapplication.c:1161:3
    #13 0x7f10dc6a13a3 in gtk_application_local_command_line gtk3/gtk/gtkapplication.c:382:10
    #14 0x7f10d9577f40 in g_application_run glib/gio/gapplication.c:2712:8
    #15 0x562a8ad9c82a in main xfce4-settings/dialogs/display-settings/main.c:3447:5

Version info

2fc61630 compiled on Arch Linux