From 8c21021a4e3da7b4ff93224eb9b01a175292107d Mon Sep 17 00:00:00 2001
From: Friedemann Kleint <Friedemann.Kleint@qt.io>
Date: Tue, 25 May 2021 11:24:21 +0200
Subject: Fix crashes when using the QImage(uchar *) data constructors, take 2

The constructors expect a range of memory that remains valid
through the lifetime of the image and may also modify it.
Crashes occurred since apparently the Py_Buffer was released before
it.

To fix this, inject code to increase the reference count
and decrease it in the cleanup function.

Fixes: PYSIDE-1563
Change-Id: Ic4a47e0f458ed5b59b88813139102a9f1490a9df
Reviewed-by: Christian Tismer <tismer@stackless.com>
(cherry picked from commit 7079bc4ffc63dd42054014b4b78bff78abed962b)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
---
 sources/pyside6/PySide6/QtGui/typesystem_gui_common.xml | 2 ++
 sources/pyside6/PySide6/glue/qtgui.cpp                  | 7 +++++++
 sources/pyside6/PySide6/templates/gui_common.xml        | 3 ++-
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/sources/pyside6/PySide6/QtGui/typesystem_gui_common.xml b/sources/pyside6/PySide6/QtGui/typesystem_gui_common.xml
index b61660b7a..ab026baf5 100644
--- a/sources/pyside6/PySide6/QtGui/typesystem_gui_common.xml
+++ b/sources/pyside6/PySide6/QtGui/typesystem_gui_common.xml
@@ -674,6 +674,8 @@
     <extra-includes>
       <include file-name="QStringList" location="global"/>
     </extra-includes>
+    <inject-code class="native" position="beginning"
+                 file="../glue/qtgui.cpp" snippet="qimage-decref-image-data"/>
 
     <modify-function signature="load(const QString&amp;, const char*)" allow-thread="yes"/>
     <modify-function signature="load(QIODevice*,const char*)" allow-thread="yes"/>
diff --git a/sources/pyside6/PySide6/glue/qtgui.cpp b/sources/pyside6/PySide6/glue/qtgui.cpp
index 48d246ddc..681539c97 100644
--- a/sources/pyside6/PySide6/glue/qtgui.cpp
+++ b/sources/pyside6/PySide6/glue/qtgui.cpp
@@ -160,6 +160,13 @@ for (Py_ssize_t i = 0; i < count; ++i){
 %0 = new %TYPE(QPixmap::fromImage(%1));
 // @snippet qpixmap
 
+// @snippet qimage-decref-image-data
+static void imageDecrefDataHandler(void *data)
+{
+    Py_DECREF(reinterpret_cast<PyObject *>(data));
+}
+// @snippet qimage-decref-image-data
+
 // @snippet qimage-constbits
 %PYARG_0 = Shiboken::Buffer::newObject(%CPPSELF.%FUNCTION_NAME(), %CPPSELF.sizeInBytes());
 // @snippet qimage-constbits
diff --git a/sources/pyside6/PySide6/templates/gui_common.xml b/sources/pyside6/PySide6/templates/gui_common.xml
index 4cc6358b4..874f8df5f 100644
--- a/sources/pyside6/PySide6/templates/gui_common.xml
+++ b/sources/pyside6/PySide6/templates/gui_common.xml
@@ -80,8 +80,9 @@
     </template>
 
     <template name="qimage_buffer_constructor">
+        Py_INCREF(%PYARG_1);
         auto ptr = reinterpret_cast&lt;uchar*&gt;(Shiboken::Buffer::getPointer(%PYARG_1));
-        %0 = new %TYPE(ptr, %ARGS);
+        %0 = new %TYPE(ptr, %ARGS, imageDecrefDataHandler, %PYARG_1);
     </template>
 
     <template name="qcolor_repr">
-- 
cgit v1.2.3