From d12acf0d01e628d71548adbb77670c7e40aef043 Mon Sep 17 00:00:00 2001
From: "Carsten Haitzler (Rasterman)" <raster@rasterman.com>
Date: Sat, 4 Sep 2021 08:51:50 +0100
Subject: [PATCH] ibox - track timer and elete it when icon deleted... bad
 tracking of tmr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

if you create a timer for some object and are passing in that ptr to
the timer later.. what happens if that icon (object, struct etc.) is
deleted BEFORE the timer fires? timer fires passing in a junk ptr to
freed memory... and this causes bad things™. don't do this. track your
timers and delete them...
---
 src/modules/ibox/e_mod_main.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/modules/ibox/e_mod_main.c b/src/modules/ibox/e_mod_main.c
index d0a43dd59..f50924f25 100644
--- a/src/modules/ibox/e_mod_main.c
+++ b/src/modules/ibox/e_mod_main.c
@@ -61,6 +61,7 @@ struct _IBox_Icon
    Evas_Object *o_holder2;
    Evas_Object *o_icon2;
    E_Client    *client;
+   Ecore_Timer *fill_timer;
    struct
    {
       unsigned char start E_BITFIELD;
@@ -523,6 +524,7 @@ _ibox_cb_icon_fill_timer(void *data)
 {
    IBox_Icon *ic = data;
 
+   ic->fill_timer = NULL;
    _ibox_icon_fill(ic);
 
    return EINA_FALSE;
@@ -557,7 +559,7 @@ _ibox_icon_new(IBox *b, E_Client *ec)
    evas_object_pass_events_set(ic->o_holder2, 1);
    evas_object_show(ic->o_holder2);
 
-   ecore_timer_add(0.1, _ibox_cb_icon_fill_timer, ic);
+   ic->fill_timer = ecore_timer_add(0.1, _ibox_cb_icon_fill_timer, ic);
    return ic;
 }
 
@@ -566,6 +568,8 @@ _ibox_icon_free(IBox_Icon *ic)
 {
    if (ic->ibox->ic_drop_before == ic)
      ic->ibox->ic_drop_before = NULL;
+   if (ic->fill_timer) ecore_timer_del(ic->fill_timer);
+   ic->fill_timer = NULL;
    _ibox_icon_empty(ic);
    evas_object_del(ic->o_holder);
    evas_object_del(ic->o_holder2);
@@ -606,9 +610,10 @@ _ibox_icon_fill_preview(IBox_Icon *ic, Eina_Bool is_retry)
    ec = ic->client;
 
    img = e_comp_object_util_frame_mirror_add(ec->frame);
-   if (!img && !is_retry)
+   if ((!img) && (!is_retry))
      {
-        ecore_timer_add(0.5, _ibox_icon_fill_timer, ic);
+        if (!ic->fill_timer)
+          ic->fill_timer = ecore_timer_add(0.5, _ibox_icon_fill_timer, ic);
         return;
      }
    w = ec->client.w;