Details
-
Bug
-
Resolution: Done
-
P2: Important
-
None
-
1.2.x
-
None
Description
In https://qt.gitorious.org/pyside/pyside/source/master:libpyside/dynamicqmetaobject.cpp#L169 there is a use-after-free bug which the attached patch fixes.
PropertyData::type() returns a new QByteStream (whose `data` is a copy of the `char*` name of the property)
However the use of `type().data()` on the stack without saving its reference means the `char*` returned by the `data()` method is immediately deallocated in the the `~QByteStream` destructor.
(Detected by AddressSanitizer)
The attached patch fixes it by holding a reference to the QByteStream returned by `type()` for the duration of the method call.
diff --git a/libpyside/dynamicqmetaobject.cpp b/libpyside/dynamicqmetaobject.cpp index 4f9af32..806b4dc 100644 --- a/libpyside/dynamicqmetaobject.cpp +++ b/libpyside/dynamicqmetaobject.cpp @@ -166,7 +166,8 @@ static bool isQRealType(const char *type) uint PropertyData::flags() const { - const char* typeName = type().data(); + const QByteArray btype(type()); + const char* typeName = btype.data(); uint flags = Invalid; if (!isVariantType(typeName)) flags |= EnumOrFlag;