1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Scanner: Avoid accessing dangling pointers in destroy_func()

Browse Source 
Usually, the object associated with the resource gets destroyed in the
destroy_resource() function.

Therefore, we need to double-check that the object is still alive before
trying to reset its m_resource.

Pick-to: 5.15
Change-Id: I26408228f58919db17eb29584a1cbd4a9427d25c
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
This commit is contained in:
Vlad Zahorodnii 2020-10-30 16:55:30 +02:00
parent 19281f9c3b
commit f73b8a94f4
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/tools/qtwaylandscanner/qtwaylandscanner.cpp
View File

@ -814,7 +814,9 @@ bool Scanner::process()
printf(" if (Q_LIKELY(that)) {\n");
printf(" that->m_resource_map.remove(resource->client(), resource);\n");
printf(" that->%s_destroy_resource(resource);\n", interfaceNameStripped);
printf(" if (that->m_resource == resource)\n");
printf("\n");
printf(" that = resource->%s_object;\n", interfaceNameStripped);
printf(" if (that && that->m_resource == resource)\n");
printf(" that->m_resource = nullptr;\n");
printf(" }\n");
printf(" delete resource;\n");