From 72c33cbadd004fb9c04fa22909dcb52f855a26c2 Mon Sep 17 00:00:00 2001
From: Orgad Shaneh <orgad.shaneh@audiocodes.com>
Date: Sun, 21 Sep 2014 22:28:19 +0300
Subject: [PATCH] Git: Fix potential heap use after free

Closing the dialog before the process terminates might lead to this.

Task-number: QTCREATORBUG-13075
Change-Id: I3b6ffcca010eb356b14d87f2a7d62090c158faba
Reviewed-by: Nikolai Kosjar <nikolai.kosjar@digia.com>
Reviewed-by: Tobias Hunger <tobias.hunger@digia.com>
---
 src/plugins/git/changeselectiondialog.cpp | 19 ++++++++++++-------
 src/plugins/git/changeselectiondialog.h   |  1 +
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/plugins/git/changeselectiondialog.cpp b/src/plugins/git/changeselectiondialog.cpp
index a333d39dd77..931d4fa881d 100644
--- a/src/plugins/git/changeselectiondialog.cpp
+++ b/src/plugins/git/changeselectiondialog.cpp
@@ -94,8 +94,8 @@ ChangeSelectionDialog::ChangeSelectionDialog(const QString &workingDirectory, Co
 
 ChangeSelectionDialog::~ChangeSelectionDialog()
 {
+    terminateProcess();
     delete m_ui;
-    delete m_process;
 }
 
 QString ChangeSelectionDialog::change() const
@@ -197,6 +197,16 @@ void ChangeSelectionDialog::enableButtons(bool b)
     m_ui->checkoutButton->setEnabled(b);
 }
 
+void ChangeSelectionDialog::terminateProcess()
+{
+    if (!m_process)
+        return;
+    m_process->kill();
+    m_process->waitForFinished();
+    delete m_process;
+    m_process = 0;
+}
+
 void ChangeSelectionDialog::recalculateCompletion()
 {
     const QString workingDir = workingDirectory();
@@ -219,12 +229,7 @@ void ChangeSelectionDialog::recalculateCompletion()
 
 void ChangeSelectionDialog::recalculateDetails()
 {
-    if (m_process) {
-        m_process->kill();
-        m_process->waitForFinished();
-        delete m_process;
-        m_process = 0;
-    }
+    terminateProcess();
     enableButtons(false);
 
     const QString workingDir = workingDirectory();
diff --git a/src/plugins/git/changeselectiondialog.h b/src/plugins/git/changeselectiondialog.h
index e6919464a18..e9c5c8ff7bb 100644
--- a/src/plugins/git/changeselectiondialog.h
+++ b/src/plugins/git/changeselectiondialog.h
@@ -85,6 +85,7 @@ private slots:
 
 private:
     void enableButtons(bool b);
+    void terminateProcess();
 
     Ui::ChangeSelectionDialog *m_ui;