1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qnetworkproxy_mac - fix proxyAutoConfigCallback

Browse Source 
We have an invalid pointer dereference in our callback.
Apple's docs are quite ambiguous, whatever we receive in our callback's
'client' parameter is our PACInfo, not clientContext's address.

That's what we pass to CFNetworkExecuteProxyAutoConfigurationURL:

"clientContext - A stream context containing a client info object and optionally
retain and release callbacks for that object."

This 'client info' is our PACInfo struct with 2 pointers.

Now in a callback, 'client':

"The client reference originally passed in the clientContext
parameter of the ..."

So apparently we should read this as "client info originally passed in ...."
Otherwise incorrect cast results in invalid pointer (apparently
the value of retain/release/copy pointers we carefully set to 0)
and a crash on dereference.

Task-number: QTBUG-56747
Change-Id: I89378f1582679638cd29a36c563e506d8f5af518
Reviewed-by: Gabriel de Dietrich <gabriel.dedietrich@qt.io>
This commit is contained in:
Timur Pocheptsov 2017-01-26 18:03:50 +01:00
parent 6d5489f5df
commit 20f7cfcbda
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/network/kernel/qnetworkproxy_mac.cpp
View File

@ -189,12 +189,19 @@ struct PACInfo {
void proxyAutoConfigCallback(void *client, CFArrayRef proxylist, CFErrorRef error)
{
PACInfo *info = reinterpret_cast<PACInfo *>(reinterpret_cast<CFStreamClientContext *>(client)->info);
Q_ASSERT(client);
PACInfo *info = static_cast<PACInfo *>(client);
info->done = true;
if (proxylist)
if (error) {
CFRetain(error);
info->error = error;
}
if (proxylist) {
CFRetain(proxylist);
info->proxies = proxylist;
info->error = error;
info->proxies = proxylist;
}
}
} // anon namespace