- Fix crasher in gsettings-data-convert caused by wrong realloc size

GConf2.spec

@@ -7,7 +7,7 @@
 Summary: A process-transparent configuration system
 Name: GConf2
 Version: 2.31.5
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: LGPLv2+
 Group: System Environment/Base
 #VCS: git:git://git.gnome.org/gconf
@@ -41,6 +41,8 @@ Conflicts: GConf2-dbus
 Patch0: GConf-2.18.0.1-reload.patch
 # http://bugzilla.gnome.org/show_bug.cgi?id=568845
 Patch1: GConf-gettext.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=609187
+Patch2: gsettings-data-convert-realloc.patch
 
 %description
 GConf is a process-transparent configuration database API used to
@@ -77,7 +79,7 @@ which require GTK+.
 %setup -q -n GConf-%{version}
 %patch0 -p1 -b .reload
 %patch1 -p1 -b .gettext
-
+%patch2 -p1 -b .realloc
 %build
 %configure --disable-static --enable-defaults-service
 
@@ -169,6 +171,9 @@ fi
 %doc %{_mandir}/man1/gsettings-schema-convert.1*
 
 %changelog
+* Tue Jun 29 2010 Matthew Garrett <mjg@redhat.com> - 2.31.5-2
+- Fix crasher in gsettings-data-convert caused by wrong realloc size
+
 * Tue Jun 29 2010 Matthias Clasen <mclasen@redhat.com> - 2.31.5-1
 - Update to 2.31.5
 

gsettings-data-convert-realloc.patch

@@ -0,0 +1,22 @@
+commit 60e77f638c6bf3fcc147cfabde0384c31a5c797d
+Author: Matthew Garrett <mjg@redhat.com>
+Date:   Tue Jun 29 15:29:26 2010 -0400
+
+    Realloc the correct amount of memory
+    
+    Pointers are more than a byte long - make sure that we realloc enough space
+    to fit another one.
+
+diff --git a/gsettings/gsettings-data-convert.c b/gsettings/gsettings-data-convert.c
+index d61c4be..ea9fe21 100644
+--- a/gsettings/gsettings-data-convert.c
++++ b/gsettings/gsettings-data-convert.c
+@@ -449,7 +449,7 @@ main (int argc, char *argv[])
+ 
+           /* Add the the file to the converted list */
+           len = g_strv_length (converted);
+-          converted = g_realloc (converted, len + 1);
++          converted = g_realloc (converted, (len + 2) * sizeof(gchar *));
+           converted[len] = g_strdup (name);
+           converted[len + 1] = NULL;
+         }