Page MenuHomePhorge

Fix use-after-free bug
AbandonedPublic

Authored by sicherha on Feb 21 2021, 11:03 AM.
Tags
None
Referenced Files
Unknown Object (File)
Mar 16 2024, 7:47 PM
Unknown Object (File)
Mar 10 2024, 9:50 PM
Unknown Object (File)
Mar 10 2024, 9:43 PM
Unknown Object (File)
Mar 10 2024, 9:38 PM
Unknown Object (File)
Feb 12 2024, 4:05 PM
Unknown Object (File)
Feb 12 2024, 3:22 PM
Unknown Object (File)
Feb 10 2024, 11:30 PM
Unknown Object (File)
Dec 30 2023, 12:44 PM
Subscribers

Details

Reviewers
mollekopf
Summary

QByteArray::fromRawData() does not copy the contents of the source
buffer. If the resulting QByteArray object lives longer than the source
buffer, we run into use-after-free problems.

In this particular instance, the source data resides in a temporary
rvalue object.

Fix dangling pointers

std::vector gives zero guarantees that pointers to its elements remain
valid when the vector's size changes. In particular, pushing new
elements into the vector may trigger reallocation of the underlying heap
area.

Consequently, Event::delegate() needs to ensure that any modifications
to the d->attendees vector are performed before pointers to its elements
are taken and collected.

Found with Valgrind.

Diff Detail

Repository
rLK libkolab
Branch
fix-memory-bugs (branched from master)
Lint
No Lint Coverage
Unit
No Test Coverage
Build Status
Buildable 33340
Build 13084: arc lint + arc unit