Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
5.6, 5.7.0
-
None
-
-
fe51dbac3d20ef9275dd1a9070f8185dc7705ad9 0383d0be33c7ede2104b7225c9af13104cbef85d c83ba01f7bc542368973f3f24dfb59c6052dd78a
Description
bool QEventDispatcherWinRT::event(QEvent *e) has a really bad memory corruption caused by copying into a dangling reference.
A reference varaible info taken from d->timerInfos:
WinRTTimerInfo &info = d->timerInfos[id];
The same reference later copy assigned even though it may be danging after d->timerInfos modifications.
info = d->timerInfos[id];
It has the right idea of getting a new "reference", but that's not how references work and this is just a balant copy assignment into potentally dangling reference.
And to top it most of the time the heap corruption causes random crashes elsewhere. There is more reckless reference usage that could use a review, but this is the biggest random heap corruptor that I have finally cought in the WinRT plugin.
Two simple fixes attached, I personally prefer the scoped with minor reordering apporach to prevent accidental usage of the first reference, but the last info.inEvent = false; after QCoreApplication::postEvent(this, new QTimerEvent(id)); might still be toxic and neither solution solves that.
Attachments
Issue Links
- mentioned in
-
Page Loading...
For Gerrit Dashboard: QTBUG-56756 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
175678,2 | winrt: Fix potential memory corruption | 5.6 | qt/qtbase | Status: MERGED | +2 | 0 |
176205,2 | winrt: Do not copy into a reference | 5.6 | qt/qtbase | Status: MERGED | +2 | 0 |
176206,2 | winrt: remove superfluous code | 5.6 | qt/qtbase | Status: MERGED | +2 | 0 |
177802,5 | winrt: Check for removed timers after sending events | 5.8 | qt/qtbase | Status: MERGED | +2 | 0 |
178492,2 | winrt: Check for removed timers after sending events | 5.6 | qt/qtbase | Status: MERGED | +2 | 0 |
179837,2 | winrt: Check for removed timers after sending events | 5.8.0 | qt/qtbase | Status: MERGED | +2 | 0 |