Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-56756

[WinRT] Dispatcher memory corruption

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 5.6, 5.7.0
    • Fix Version/s: 5.6.3, 5.7.2, 5.8.0 RC
    • Component/s: Core: Event loop
    • Labels:
      None
    • Platform/s:
      WinRT
    • Commits:
      fe51dbac3d20ef9275dd1a9070f8185dc7705ad9 0383d0be33c7ede2104b7225c9af13104cbef85d c83ba01f7bc542368973f3f24dfb59c6052dd78a

      Description

      bool QEventDispatcherWinRT::event(QEvent *e) has a really bad memory corruption caused by copying into a dangling reference.

      A reference varaible info taken from d->timerInfos:

      WinRTTimerInfo &info = d->timerInfos[id];

      The same reference later copy assigned even though it may be danging after d->timerInfos modifications.

      info = d->timerInfos[id];

      It has the right idea of getting a new "reference", but that's not how references work and this is just a balant copy assignment into potentally dangling reference.

      And to top it most of the time the heap corruption causes random crashes elsewhere. There is more reckless reference usage that could use a review, but this is the biggest random heap corruptor that I have finally cought in the WinRT plugin.

      Two simple fixes attached, I personally prefer the scoped with minor reordering apporach to prevent accidental usage of the first reference, but the last info.inEvent = false; after QCoreApplication::postEvent(this, new QTimerEvent(id)); might still be toxic and neither solution solves that.

        Attachments

          Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            Activity

              People

              Assignee:
              owolff Oliver Wolff
              Reporter:
              kristjanbb Kristján Birgisson
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes