The variable "error" is declared as gboolean, but then assigned via a call to g_object_get() on the "error" property. However, that property is a string (the error message) or NULL if no error. Since g_object_get() is a variadic function, the compiler will not catch this. On alignement critical architectures the pointer assignement to &error may cause a crash. On others, still some part of the stack may be overwritten. Fix is simple: declare gpointer error = NULL; and change the test from if (error == TRUE) to if (error != NULL)
The same bug can be found in swfmoz_dialog.c:swfmoz_dialog_save_media
Created attachment 56957 [details] [review] patch we use in pkgsrc to fix the first instance
Created attachment 56958 [details] pkgsrc patch for second instance
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.