whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QToolBox: fix potential UB (invalid cast) in Private::_q_widgetDestroyed() 

Don't cast an expiring QObject down to QWidget. Cast the QWidgets stored
internally up to QObject to perform the comparison. The result is the
same, but no invalid casts are possible anymore.

Found by independent review.

Change-Id: Iffa8a66cf5cab0270961befe982637ac8e4f0f7b
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
bb10
Marc Mutz 2017-03-21 14:13:34 +01:00
parent 05924ddff9
commit 26bc4ac5cb
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/widgets/widgets/qtoolbox.cpp
View File

@ -117,7 +117,7 @@ public:
void _q_buttonClicked();
void _q_widgetDestroyed(QObject*);
const Page *page(QWidget *widget) const;
const Page *page(const QObject *widget) const;
const Page *page(int index) const;
Page *page(int index);
@ -129,7 +129,7 @@ public:
Page *currentPage;
};
const QToolBoxPrivate::Page *QToolBoxPrivate::page(QWidget *widget) const
const QToolBoxPrivate::Page *QToolBoxPrivate::page(const QObject *widget) const
{
if (!widget)
return 0;
@ -449,11 +449,9 @@ void QToolBoxPrivate::relayout()
void QToolBoxPrivate::_q_widgetDestroyed(QObject *object)
{
Q_Q(QToolBox);
// no verification - vtbl corrupted already
QWidget *p = (QWidget*)object;
const QToolBoxPrivate::Page *c = page(p);
if (!p || !c)
const QToolBoxPrivate::Page * const c = page(object);
if (!c)
return;
layout->removeWidget(c->sv);