Blame SOURCES/0005-Scanner-Avoid-accessing-dangling-pointers-in-destroy.patch

c54cd9
From e5c272423d1bba2825086b82fd97499237a6fa4b Mon Sep 17 00:00:00 2001
c54cd9
From: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
c54cd9
Date: Fri, 30 Oct 2020 16:55:30 +0200
de89c0
Subject: [PATCH 05/36] Scanner: Avoid accessing dangling pointers in
de89c0
 destroy_func()
c54cd9
c54cd9
Usually, the object associated with the resource gets destroyed in the
c54cd9
destroy_resource() function.
c54cd9
c54cd9
Therefore, we need to double-check that the object is still alive before
c54cd9
trying to reset its m_resource.
c54cd9
c54cd9
Change-Id: I26408228f58919db17eb29584a1cbd4a9427d25c
c54cd9
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
c54cd9
(cherry picked from commit 735164b5c2a2637a8d53a8803a2401e4ef477ff0)
c54cd9
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
c54cd9
---
de89c0
 src/qtwaylandscanner/qtwaylandscanner.cpp | 4 +++-
de89c0
 1 file changed, 3 insertions(+), 1 deletion(-)
c54cd9
c54cd9
diff --git a/src/qtwaylandscanner/qtwaylandscanner.cpp b/src/qtwaylandscanner/qtwaylandscanner.cpp
de89c0
index 1d635f06..e2f87bbd 100644
c54cd9
--- a/src/qtwaylandscanner/qtwaylandscanner.cpp
c54cd9
+++ b/src/qtwaylandscanner/qtwaylandscanner.cpp
de89c0
@@ -814,7 +814,9 @@ bool Scanner::process()
c54cd9
             printf("        if (Q_LIKELY(that)) {\n");
c54cd9
             printf("            that->m_resource_map.remove(resource->client(), resource);\n");
c54cd9
             printf("            that->%s_destroy_resource(resource);\n", interfaceNameStripped);
c54cd9
-            printf("            if (that->m_resource == resource)\n");
c54cd9
+            printf("\n");
c54cd9
+            printf("            that = resource->%s_object;\n", interfaceNameStripped);
c54cd9
+            printf("            if (that && that->m_resource == resource)\n");
c54cd9
             printf("                that->m_resource = nullptr;\n");
c54cd9
             printf("        }\n");
c54cd9
             printf("        delete resource;\n");
de89c0
-- 
de89c0
2.33.1
de89c0