Uploaded image for project: 'Qt for Python'
  1. Qt for Python
  2. PYSIDE-215

ASAN detected: QtCore.Property use-after-free on QByteArray

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P2: Important
    • None
    • 1.2.x
    • PySide
    • None

    Description

      In https://qt.gitorious.org/pyside/pyside/source/master:libpyside/dynamicqmetaobject.cpp#L169 there is a use-after-free bug which the attached patch fixes.

      PropertyData::type() returns a new QByteStream (whose `data` is a copy of the `char*` name of the property)
      However the use of `type().data()` on the stack without saving its reference means the `char*` returned by the `data()` method is immediately deallocated in the the `~QByteStream` destructor.
      (Detected by AddressSanitizer)
      The attached patch fixes it by holding a reference to the QByteStream returned by `type()` for the duration of the method call.

      diff --git a/libpyside/dynamicqmetaobject.cpp b/libpyside/dynamicqmetaobject.cpp
      index 4f9af32..806b4dc 100644
      --- a/libpyside/dynamicqmetaobject.cpp
      +++ b/libpyside/dynamicqmetaobject.cpp
      @@ -166,7 +166,8 @@ static bool isQRealType(const char *type)
       
       uint PropertyData::flags() const
       {
      -    const char* typeName = type().data();
      +    const QByteArray btype(type());
      +    const char* typeName = btype.data();
           uint flags = Invalid;
           if (!isVariantType(typeName))
                flags |= EnumOrFlag;
      

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            ctismer Christian Tismer
            pankajp Pankaj Pandey
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes