summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOlivier Goffart <ogoffart@woboq.com>2017-04-19 11:16:14 +0200
committerOlivier Goffart (Woboq GmbH) <ogoffart@woboq.com>2017-04-23 10:11:14 +0000
commit2eee24702b8f3a83e8fdd810fa22f2fe65ee848b (patch)
treea795b0ea79b1d0584d16125dc3f8944a62d5ceb6
parent88b6abcebf29b455438d8da7db9fd5aa1aed2bf5 (diff)
Fix UB in QSplitter::childEvent
The widget might be in the QObject destructor when the event is received, so we can't static cast. There is no need to check for isWindow for ChildRemoved because it would not otherwise be on our list. Change-Id: Ifc0a2979f1f6720f1963399276a28ac4a3224fff Reviewed-by: Marc Mutz <marc.mutz@kdab.com> Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
-rw-r--r--src/widgets/widgets/qsplitter.cpp19
1 files changed, 10 insertions, 9 deletions
diff --git a/src/widgets/widgets/qsplitter.cpp b/src/widgets/widgets/qsplitter.cpp
index 4c077f5f9f..0c98c3875a 100644
--- a/src/widgets/widgets/qsplitter.cpp
+++ b/src/widgets/widgets/qsplitter.cpp
@@ -1298,18 +1298,19 @@ void QSplitter::childEvent(QChildEvent *c)
qWarning("Adding a QLayout to a QSplitter is not supported.");
return;
}
- QWidget *w = static_cast<QWidget*>(c->child());
- if (w->isWindow())
- return;
- if (c->added() && !d->blockChildAdd && !d->findWidget(w)) {
- d->insertWidget_helper(d->list.count(), w, false);
- } else if (c->polished() && !d->blockChildAdd) {
- if (d->shouldShowWidget(w))
+ if (c->added()) {
+ QWidget *w = static_cast<QWidget*>(c->child());
+ if (!d->blockChildAdd && !w->isWindow() && !d->findWidget(w))
+ d->insertWidget_helper(d->list.count(), w, false);
+ } else if (c->polished()) {
+ QWidget *w = static_cast<QWidget*>(c->child());
+ if (!d->blockChildAdd && !w->isWindow() && d->shouldShowWidget(w))
w->show();
- } else if (c->type() == QEvent::ChildRemoved) {
+ } else if (c->removed()) {
+ QObject *child = c->child();
for (int i = 0; i < d->list.size(); ++i) {
QSplitterLayoutStruct *s = d->list.at(i);
- if (s->widget == w) {
+ if (s->widget == child) {
d->list.removeAt(i);
delete s;
d->recalc(isVisible());