Bug: Application crashes when connecting to an SSH server.
Root cause: The IO thread uses g_idle_add() to notify the UI of status changes. If the SshTerminal object is destroyed before the idle callback fires, the callback accesses freed memory (use-after-free).
Timeline:
IO thread calls g_idle_add(callback, self) to queue status notification
disconnect() joins the thread (thread finishes)
Pending idle callback still references self
SshTerminal destructor destroys vte_box_ and frees the object
Idle callback fires - accesses freed self pointer
Fix: In ssh_terminal.cpp, added idle callback flush after thread join in disconnect():
**Bug:** Application crashes when connecting to an SSH server.
**Root cause:** The IO thread uses `g_idle_add()` to notify the UI of status changes. If the SshTerminal object is destroyed before the idle callback fires, the callback accesses freed memory (use-after-free).
Timeline:
1. IO thread calls `g_idle_add(callback, self)` to queue status notification
2. `disconnect()` joins the thread (thread finishes)
3. Pending idle callback still references `self`
4. `SshTerminal` destructor destroys `vte_box_` and frees the object
5. Idle callback fires - accesses freed `self` pointer
**Fix:** In `ssh_terminal.cpp`, added idle callback flush after thread join in `disconnect()`:
```cpp
void SshTerminal::disconnect() {
running_ = false;
if (thread_) {
g_thread_join(thread_);
thread_ = nullptr;
}
// Flush pending idle callbacks before cleanup
while (g_main_context_pending(NULL))
g_main_context_iteration(NULL, FALSE);
// ... cleanup ...
}
```
Also added `g_message`/`g_warning` logging to SSH connect, auth, and IO thread operations for better diagnostics.
**Status:** Fixed in commit fe7050c
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bug: Application crashes when connecting to an SSH server.
Root cause: The IO thread uses
g_idle_add()to notify the UI of status changes. If the SshTerminal object is destroyed before the idle callback fires, the callback accesses freed memory (use-after-free).Timeline:
g_idle_add(callback, self)to queue status notificationdisconnect()joins the thread (thread finishes)selfSshTerminaldestructor destroysvte_box_and frees the objectselfpointerFix: In
ssh_terminal.cpp, added idle callback flush after thread join indisconnect():Also added
g_message/g_warninglogging to SSH connect, auth, and IO thread operations for better diagnostics.Status: Fixed in commit
fe7050c