file-transfer: Fix SpiceFileTransferTask::error leak

The self->error is the error set for the file-transfer and it will be
propagated with the "finish" signal. As this is transfer none pointer,
we should not lose its reference on g_task_return_error and we should
clear it out afterwards.

40 (16 direct, 24 indirect) bytes in 1 blocks are definitely lost in
loss record 7,489 of 14,298
 at 0x4C2BBAD: malloc (vg_replace_malloc.c:299)
 by 0xB5090E8: g_malloc (gmem.c:94)
 by 0xB51F8A2: g_slice_alloc (gslice.c:1025)
 by 0xB4EFCC5: g_error_new_literal (gerror.c:471)
 by 0xB4EFFAD: g_set_error_literal (gerror.c:619)
 by 0xAF13397: g_cancellable_set_error_if_cancelled (gcancellable.c:314)
 by 0xAF630C8: g_task_propagate_error (gtask.c:1519)
 by 0xAF63CD8: g_task_propagate_int (gtask.c:1652)
 by 0x50863F5: spice_file_transfer_task_read_finish (spice-file-transfer-task.c:477)
 by 0x5093239: file_xfer_read_async_cb (channel-main.c:1811)
 by 0xAF62F38: g_task_return_now (gtask.c:1121)
 by 0xAF63775: g_task_return (gtask.c:1179)

1 files changed, 4 insertions, 3 deletions

diff --git a/src/spice-file-transfer-task.c b/src/spice-file-transfer-task.c
index ea46c9d..5bb6359 100644
--- a/src/spice-file-transfer-task.c
+++ b/src/spice-file-transfer-task.c
@@ -117,7 +117,7 @@ static void spice_file_transfer_task_query_info_cb(GObject *obj,
     info = g_file_query_info_finish(G_FILE(obj), res, &error);
     if (self->error) {
         /* Return error previously reported */
-        g_task_return_error(task, self->error);
+        g_task_return_error(task, g_error_copy(self->error));
         g_object_unref(task);
         return;
     } else if (error) {
@@ -154,7 +154,7 @@ static void spice_file_transfer_task_read_file_cb(GObject *obj,
     if (self->error) {
         /* Return error previously reported */
         self->pending = FALSE;
-        g_task_return_error(task, self->error);
+        g_task_return_error(task, g_error_copy(self->error));
         g_object_unref(task);
         return;
     } else if (error) {
@@ -191,7 +191,7 @@ static void spice_file_transfer_task_read_stream_cb(GObject *source_object,
     nbytes = g_input_stream_read_finish(G_INPUT_STREAM(self->file_stream), res, &error);
     if (self->error) {
         /* On any pending error on SpiceFileTransferTask */
-        g_task_return_error(task, self->error);
+        g_task_return_error(task, g_error_copy(self->error));
         g_object_unref(task);
         return;
     } else if (error) {
@@ -589,6 +589,7 @@ spice_file_transfer_task_dispose(GObject *object)
 
     g_clear_object(&self->file);
     g_clear_object(&self->file_stream);
+    g_clear_error(&self->error);
 
     G_OBJECT_CLASS(spice_file_transfer_task_parent_class)->dispose(object);
 }