Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-86547

Heap corruption happens due to double memory release when QDomAttr::setNodeValue is called.

    XMLWordPrintable

Details

    • Windows
    • af22ccf5605c6b7b20b845fb2b4003d3f56d8bc9 (qt/qtbase/dev) c7e5f92aac16c83611c6b106fbdf311d0a474548 (qt/qtbase/5.15) 0692398b0b1ce505d8d84791dfd99c390c8ecf69 (qt/qtbase/5.12)

    Description

      When QDomAttr::setNodeValue is called, it causes double memory release, hence
      the program halts and produces the following message.

      HEAP[QDomAttr_DoubleRelease.exe]: HEAP: Free Heap block 0000023C5B729CE0 modified at 0000023C5B729D28 after it was freed
      

      The problem seems to come from the following part in qdom.cpp.

      void QDomAttrPrivate::setNodeValue(const QString& v)
      {
          value = v;
          QDomTextPrivate *t = new QDomTextPrivate(nullptr, this, v);
          // keep the refcount balanced: appendChild() does a ref anyway.
          t->ref.deref();
          if (first) {
              delete removeChild(first);  // <--- This deletes without checking the reference count of the return value of removeChild
          }
          appendChild(t);
      }
      

      The attached patch qtbug86547.patch seems to fix the problem in Qt5.12.7.
      It'd be nice to have a fix in Qt5.15 series.

      How to reproduce the problem
      Run QDomAttr_DoubleRelease.zip

      Attachments

        1. qtbug86547.zip
          0.9 kB
        2. qtbug86547.patch
          0.4 kB
        3. qtbug86547.diff
          0.5 kB
        4. qtbug86547_valgrind.txt
          19 kB
        5. QDomAttr_DoubleRelease.zip
          0.9 kB
        For Gerrit Dashboard: QTBUG-86547
        # Subject Branch Project Status CR V

        Activity

          People

            kleint Friedemann Kleint
            nagrohn Nahomi Gröhn (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes