feedc0de/qt-creator
1
0
Fork 0
forked from qt-creator/qt-creator
Code Pull Requests Activity

QmlDesigner: Fixing double free

Browse Source 
Calling detach() in setKey() will free the shared memory twice, if
we do not set m_memory to nullptr.
Clean cleanHandleInternal() does always return true, so
checking the value does not make sense.
We have to call cleanHandleInternal() immediately after the close.

Change-Id: I110693d1dd9dae4ff5e52cfd3fdd2f33137af969
Reviewed-by: Tobias Hunger <tobias.hunger@qt.io>
This commit is contained in:
Thomas Hartmann
2016-11-29 16:53:03 +01:00
parent 337393ce97
commit 5eeecdb1b4
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
share/qtcreator/qml/qmlpuppet/container/sharedmemory.h
View File

@@ -61,7 +61,7 @@ public:
protected: protected:
#ifdef Q_OS_UNIX #ifdef Q_OS_UNIX
bool initKeyInternal(); bool initKeyInternal();
bool cleanHandleInternal(); void cleanHandleInternal();
bool createInternal(QSharedMemory::AccessMode mode, int size); bool createInternal(QSharedMemory::AccessMode mode, int size);
bool attachInternal(QSharedMemory::AccessMode mode); bool attachInternal(QSharedMemory::AccessMode mode);
bool detachInternal(); bool detachInternal();

11
share/qtcreator/qml/qmlpuppet/container/sharedmemory_unix.cpp
View File

@@ -124,10 +124,13 @@ SharedMemory::~SharedMemory()
{ {
if (m_memory) { if (m_memory) {
munmap(m_memory, m_size); munmap(m_memory, m_size);
m_memory = nullptr;
m_size = 0;
} }
if (m_fileHandle != -1) { if (m_fileHandle != -1) {
close(m_fileHandle); close(m_fileHandle);
cleanHandleInternal();
if (m_createdByMe) if (m_createdByMe)
shm_unlink(m_nativeKey); shm_unlink(m_nativeKey);
} }
@@ -142,7 +145,7 @@ void SharedMemory::setKey(const QString &key)
if (isAttached()) if (isAttached())
detach(); detach();
cleanHandleInternal();
m_key = key; m_key = key;
m_nativeKey = makePlatformSafeKey(key); m_nativeKey = makePlatformSafeKey(key);
} }
@@ -299,8 +302,7 @@ void SharedMemory::setErrorString(const QString &function)
bool SharedMemory::initKeyInternal() bool SharedMemory::initKeyInternal()
{ {
if (!cleanHandleInternal()) cleanHandleInternal();
return false;
m_systemSemaphore.setKey(QString(), 1); m_systemSemaphore.setKey(QString(), 1);
m_systemSemaphore.setKey(m_key, 1); m_systemSemaphore.setKey(m_key, 1);
@@ -341,10 +343,9 @@ int SharedMemory::handle()
return m_fileHandle; return m_fileHandle;
} }
bool SharedMemory::cleanHandleInternal() void SharedMemory::cleanHandleInternal()
{ {
m_fileHandle = -1; m_fileHandle = -1;
return true;
} }
bool SharedMemory::createInternal(QSharedMemory::AccessMode mode, int size) bool SharedMemory::createInternal(QSharedMemory::AccessMode mode, int size)