Backport two crasher fixes from upstream

0001-Use-gs_plugin_add_app-avoid-dangling-pointer.patch

@@ -0,0 +1,42 @@
+From 69defb21e0236bcecfe0870e3e2b2d9fd266ddcf Mon Sep 17 00:00:00 2001
+From: Rafal Luzynski <digitalfreak@lingonborough.com>
+Date: Sun, 27 Sep 2015 01:57:50 +0200
+Subject: [PATCH] Use gs_plugin_add_app(), avoid dangling pointer
+
+The gs_plugin_loader_run_refine() function assumes that the list
+holds a reference to each of its apps and it unrefs each app when
+removing. This causes a dangling pointer and severe memory corruption
+issues if a reference is not held. gs_plugin_add_app() is a helper
+which ensures a correct reference management and it has been used
+correctly everywhere except install, remove and rating action.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=755664
+---
+ src/gs-plugin-loader.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/gs-plugin-loader.c b/src/gs-plugin-loader.c
+index 5e910d9..f43a74f 100644
+--- a/src/gs-plugin-loader.c
++++ b/src/gs-plugin-loader.c
+@@ -2312,7 +2312,7 @@ gs_plugin_loader_app_action_thread_cb (GTask *task,
+ 	GPtrArray *addons;
+ 	gboolean ret;
+ 	guint i;
+-	g_autoptr(GList) list = NULL;
++	g_autoptr(GsAppList) list = NULL;
+ 
+ 	/* add to list */
+ 	g_mutex_lock (&priv->pending_apps_mutex);
+@@ -2340,7 +2340,7 @@ gs_plugin_loader_app_action_thread_cb (GTask *task,
+ 		}
+ 
+ 		/* refine again to make sure we pick up new source id */
+-		list = g_list_prepend (list, state->app);
++		gs_plugin_add_app (&list, state->app);
+ 		ret = gs_plugin_loader_run_refine (plugin_loader,
+ 						   state->function_name,
+ 						   &list,
+-- 
+2.5.0
+

0001-shell-details-Disconnect-old-signal-handlers-before-.patch

@@ -0,0 +1,82 @@
+From 381ed8efca0139a14bd1f220b6e9a432663d335e Mon Sep 17 00:00:00 2001
+From: Rafal Luzynski <digitalfreak@lingonborough.com>
+Date: Mon, 28 Sep 2015 11:52:38 +0200
+Subject: [PATCH] shell details: Disconnect old signal handlers before setting
+ new app
+
+While at this, also make sure to connect to notify::progress not only
+when installing from repos, but when installing local rpms as well.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=755664
+---
+ src/gs-shell-details.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/src/gs-shell-details.c b/src/gs-shell-details.c
+index 477a949..57c79b0 100644
+--- a/src/gs-shell-details.c
++++ b/src/gs-shell-details.c
+@@ -911,8 +911,12 @@ gs_shell_details_filename_to_app_cb (GObject *source,
+ 	g_autoptr(GError) error = NULL;
+ 	g_autofree gchar *tmp = NULL;
+ 
+-	if (self->app != NULL)
++	/* save app */
++	if (self->app != NULL) {
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_notify_state_changed_cb, self);
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_progress_changed_cb, self);
+ 		g_object_unref (self->app);
++	}
+ 	self->app = gs_plugin_loader_filename_to_app_finish(plugin_loader,
+ 							    res,
+ 							    &error);
+@@ -938,7 +942,6 @@ gs_shell_details_filename_to_app_cb (GObject *source,
+ 		return;
+ 	}
+ 
+-	/* save app */
+ 	g_signal_connect_object (self->app, "notify::state",
+ 				 G_CALLBACK (gs_shell_details_notify_state_changed_cb),
+ 				 self, 0);
+@@ -948,6 +951,9 @@ gs_shell_details_filename_to_app_cb (GObject *source,
+ 	g_signal_connect_object (self->app, "notify::licence",
+ 				 G_CALLBACK (gs_shell_details_notify_state_changed_cb),
+ 				 self, 0);
++	g_signal_connect_object (self->app, "notify::progress",
++				 G_CALLBACK (gs_shell_details_progress_changed_cb),
++				 self, 0);
+ 
+ 	/* print what we've got */
+ 	tmp = gs_app_to_string (self->app);
+@@ -1019,8 +1025,11 @@ gs_shell_details_set_app (GsShellDetails *self, GsApp *app)
+ 	gs_shell_details_set_state (self, GS_SHELL_DETAILS_STATE_LOADING);
+ 
+ 	/* save app */
+-	if (self->app != NULL)
++	if (self->app != NULL) {
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_notify_state_changed_cb, self);
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_progress_changed_cb, self);
+ 		g_object_unref (self->app);
++	}
+ 	self->app = g_object_ref (app);
+ 	g_signal_connect_object (self->app, "notify::state",
+ 				 G_CALLBACK (gs_shell_details_notify_state_changed_cb),
+@@ -1271,10 +1280,14 @@ gs_shell_details_dispose (GObject *object)
+ {
+ 	GsShellDetails *self = GS_SHELL_DETAILS (object);
+ 
++	if (self->app != NULL) {
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_notify_state_changed_cb, self);
++		g_signal_handlers_disconnect_by_func (self->app, gs_shell_details_progress_changed_cb, self);
++		g_clear_object (&self->app);
++	}
+ 	g_clear_object (&self->builder);
+ 	g_clear_object (&self->plugin_loader);
+ 	g_clear_object (&self->cancellable);
+-	g_clear_object (&self->app);
+ 	g_clear_object (&self->session);
+ 
+ 	G_OBJECT_CLASS (gs_shell_details_parent_class)->dispose (object);
+-- 
+2.5.0
+

gnome-software.spec

@@ -9,7 +9,7 @@
 Summary:   A software center for GNOME
 Name:      gnome-software
 Version:   3.18.0
-Release:   1%{?dist}
+Release:   2%{?dist}
 License:   GPLv2+
 Group:     Applications/System
 URL:       https://wiki.gnome.org/Apps/Software
@@ -19,6 +19,9 @@ Source0:   http://download.gnome.org/sources/gnome-software/3.18/%{name}-%{versi
 Patch0:    gnome-software-system-apps.patch
 # Downstream patch to adapt to gnome-terminal desktop file rename
 Patch1:    gnome-software-adapt-to-gnome-terminal-rename.patch
+# Backported upstream fixes
+Patch2:    0001-Use-gs_plugin_add_app-avoid-dangling-pointer.patch
+Patch3:    0001-shell-details-Disconnect-old-signal-handlers-before-.patch
 
 Requires:  appstream-data
 %if 0%{?fedora}
@@ -61,6 +64,8 @@ and update software in the GNOME desktop.
 %setup -q
 %patch0 -p1 -b .system-apps
 %patch1 -p1 -b .gnome-terminal
+%patch2 -p1
+%patch3 -p1
 
 %build
 %configure --disable-static --disable-silent-rules
@@ -117,6 +122,9 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
 %{_datadir}/gnome-software/modulesets.d/*.xml
 
 %changelog
+* Wed Oct 07 2015 Kalev Lember <klember@redhat.com> - 3.18.0-2
+- Backport two crasher fixes from upstream
+
 * Mon Sep 21 2015 Kalev Lember <klember@redhat.com> - 3.18.0-1
 - Update to 3.18.0