Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-95440

qtwayland: use-after-free in autogenerated qwayland-server-wayland.cpp

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P2: Important
    • 5.15.3, 6.0.0
    • 5.15.2
    • Wayland Compositor
    • None
    • All
    • 735164b5c2a2637a8d53a8803a2401e4ef477ff0

    Description

      In autogenerated code, I see next implementation:

      qwayland-server-wayland.cpp:

      void wl_region::destroy_func(struct ::wl_resource *client_resource)
          {
              Resource *resource = Resource::fromResource(client_resource);
              Q_ASSERT(resource);
              wl_region *that = resource->region_object;
              if (Q_LIKELY(that)) {
                  that->m_resource_map.remove(resource->client(), resource);
                  that->region_destroy_resource(resource);
                  if (that->m_resource == resource)\n");
                      that->m_resource = nullptr;\n");
              }
              delete resource;
          }
      

       
       
      this->region_destroy_resource(resource) is defined in 
      qtwayland/src/compositor/wayland_wrapper/qwlregion.cpp:

      void Region::region_destroy_resource(Resource *)
      {
          delete this;
      }
      

      The problem is in access to 
      that->m_resource
       
      Actually after call region_destroy_resource(), this is access to released memory.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            qt.team.graphics.and.multimedia Qt Graphics Team
            vasily_dybala Vasily Dybala
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes