alecs/plasma-framework
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Fix potential use-after-free in FrameSVG.

Browse Source 
Plasma framework's FrameSVG class uses cached regions for efficiency. However
Coverity caught a mis-use of QCache in FrameSvg::mask(), which could lead to a
use-after-free situation. (CID 1291560)

Basically, any pointer passed into QCache::insert must be assumed to be deleted
after insert() has been called -- we can't then return that pointer to the
caller.

Moreover we were simply returning a pointer to calling code that had been (and
still would be) owned by QCache, which is unsafe as it can be deleted at any
time. The fix in both cases is to make a local copy of the QRegion from out of
the cache and return that.

REVIEW:126411
FIXED-IN:5.18
This commit is contained in:
Michael Pyne 2015-12-17 21:34:04 -05:00
parent a1feac929b
commit 600bdda045
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/plasma/framesvg.cpp
View File

@ -500,12 +500,17 @@ QRegion FrameSvg::mask() const
QString id = d->cacheId(frame, QString()); QString id = d->cacheId(frame, QString());
QRegion* obj = frame->cachedMasks.object(id); QRegion* obj = frame->cachedMasks.object(id);
QRegion result;
if (!obj) { if (!obj) {
obj = new QRegion(QBitmap(d->alphaMask().alphaChannel().createMaskFromColor(Qt::black))); obj = new QRegion(QBitmap(d->alphaMask().alphaChannel().createMaskFromColor(Qt::black)));
result = *obj;
frame->cachedMasks.insert(id, obj); frame->cachedMasks.insert(id, obj);
} }
return *obj; else {
result = *obj;
}
return result;
} }
void FrameSvg::setCacheAllRenderedFrames(bool cache) void FrameSvg::setCacheAllRenderedFrames(bool cache)