Change Details

QByteArray::fromRawData() does not copy the contents of the source buffer. If the resulting QByteArray object lives longer than the source buffer, we run into use-after-free problems. In this particular instance, the source data resides in a temporary rvalue object. Fix dangling pointers std::vector gives zero guarantees that pointers to its elements remain valid when the vector's size changes. In particular, pushing new elements into the vector may trigger reallocation of the underlying heap area. Consequently, Event::delegate() needs to ensure that any modifications to the d->attendees vector are performed before pointers to its elements are taken and collected. Found with Valgrind. Fix memory leaks in tests QTest::toString() returns a pointer to a dynamically allocated character array. According to the Qt documentation, '[t]he caller has ownership of the returned pointer and must ensure it is later passed to operator delete[]'.

This revision comprises three patches that fix a use-after-free bug, potential access to dangling pointers, and a bunch of memory leaks in the tests. **Fix use-after-free bug** QByteArray::fromRawData() does not copy the contents of the source buffer. If the resulting QByteArray object lives longer than the source buffer, we run into use-after-free problems. In this particular instance, the source data resides in a temporary rvalue object. **Fix dangling pointers** std::vector gives zero guarantees that pointers to its elements remain valid when the vector's size changes. In particular, pushing new elements into the vector may trigger reallocation of the underlying heap area. Consequently, Event::delegate() needs to ensure that any modifications to the d->attendees vector are performed before pointers to its elements are taken and collected. Found with Valgrind. **Fix memory leaks in tests** QTest::toString() returns a pointer to a dynamically allocated character array. According to the Qt documentation, '[t]he caller has ownership of the returned pointer and must ensure it is later passed to operator delete[]'.

This revision comprises three patches that fix a use-after-free bug, potential access to dangling pointers, and a bunch of memory leaks in the tests. **Fix use-after-free bug** QByteArray::fromRawData() does not copy the contents of the source buffer. If the resulting QByteArray object lives longer than the source buffer, we run into use-after-free problems. In this particular instance, the source data resides in a temporary rvalue object. **Fix dangling pointers** std::vector gives zero guarantees that pointers to its elements remain valid when the vector's size changes. In particular, pushing new elements into the vector may trigger reallocation of the underlying heap area. Consequently, Event::delegate() needs to ensure that any modifications to the d->attendees vector are performed before pointers to its elements are taken and collected. Found with Valgrind. **Fix memory leaks in tests** QTest::toString() returns a pointer to a dynamically allocated character array. According to the Qt documentation, '[t]he caller has ownership of the returned pointer and must ensure it is later passed to operator delete[]'.