Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-36848

Crash with wacom tablet on Mac due to use-after-free of QWidgetWindow global qt_tablet_target

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P1: Critical
    • None
    • 5.2.1
    • Mac OS X 10.8.5, Qt 5.2.1, Wacom Intuos
    • macOS
    • 2bac49265efcf8faabc3756d1a3e405a3d336f68

    Description

      You can crash Qt 5.2.1 on a Mac using an input tablet.
      Use the attached program as an example.
      Using the tablet, press the "CLOSE" button in the top window.
      Then move over to the other window. The application crashes.

      The QWidgetWindow class uses a global QWidget pointer called 'qt_tablet_target' for receiving tablet events.

      On the Mac, this pointer can be accessed after it has been freed.

      The QWidgetWindow code assumes that it will only receive TabletMove events after it receives a TabletPress event. But on the Mac this is not the case.

      So after closing and deleting the first window, the TabletMove event gets sent to the second window, which has not received a TabletPress event. It tries to call qt_tablet_target->mapFromGlobal() and crashes, because the QWidget that qt_tablet_target points to has been destroyed.

      The easiest solution is to use a QPointer for qt_tablet_target.

      Another option would be to make sure not to send the tablet event to a window that hasn't yet received a TabletPress event.

      Attachments

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              srutledg Shawn Rutledge
              dzedsystems Dyami Caliri
              Votes:
              1 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Gerrit Reviews

                  There are no open Gerrit changes