diff options
| author | Jesus Fernandez <jesus.fernandez@qt.io> | 2017-10-23 20:42:12 +0200 |
|---|---|---|
| committer | Jesus Fernandez <Jesus.Fernandez@qt.io> | 2017-10-24 08:49:11 +0000 |
| commit | ee17851b42f21bb92c4b7581e80c0319e5384e6b (patch) | |
| tree | f3417b0c888c405b004b0f51142fcf9971ac8489 | |
| parent | a8dda66d7738cde9042b87db27993f710ae3eeeb (diff) | |
Fix use after free
This could cause an immediate crash or incorrect values might be read
subsequently resulting in incorrect computations.
In QtFlagPropertyManager::uninitializeProperty(QtProperty *): A
pointer to freed memory is dereferenced, used as a function argument, or
otherwise used (CWE-416)
Coverity-Id: 22622
Change-Id: I24fc9d6f7c1c516ddcadaaba2ba7cdaed7c7f807
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
| -rw-r--r-- | qtpropertybrowser/src/qtpropertymanager.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/qtpropertybrowser/src/qtpropertymanager.cpp b/qtpropertybrowser/src/qtpropertymanager.cpp index a3bc78c..4da2ef8 100644 --- a/qtpropertybrowser/src/qtpropertymanager.cpp +++ b/qtpropertybrowser/src/qtpropertymanager.cpp @@ -5355,8 +5355,8 @@ void QtFlagPropertyManager::setFlagNames(QtProperty *property, const QStringList while (itProp.hasNext()) { QtProperty *prop = itProp.next(); if (prop) { - delete prop; d_ptr->m_flagToProperty.remove(prop); + delete prop; } } d_ptr->m_propertyToFlags[property].clear(); @@ -5396,8 +5396,8 @@ void QtFlagPropertyManager::uninitializeProperty(QtProperty *property) while (itProp.hasNext()) { QtProperty *prop = itProp.next(); if (prop) { - delete prop; d_ptr->m_flagToProperty.remove(prop); + delete prop; } } d_ptr->m_propertyToFlags.remove(property); |