diff options
| author | Allan Sandfeld Jensen <allan.jensen@theqtcompany.com> | 2016-10-10 11:30:51 +0200 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@kdab.com> | 2016-10-12 08:16:24 +0000 |
| commit | 9ad4157530e86a1bac7ab8ca50ba3ee9f839f536 (patch) | |
| tree | 846fec696a0dafff90d1ed3ef9d315fe218eb507 /src/gui/painting/qdrawhelper_p.h | |
| parent | f6498fd6776b08b6bd33395e3f716b6d5d79a8b8 (diff) | |
Fix gradient race condition / read-after-free
A gradient table may be deallocated while in use because we don't keep
track of references. To fix it we now reference count the cache entries.
Task-number: QTBUG-14614
Change-Id: I772ebf565ccf41d476811ca9a51b721f10de8aeb
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Diffstat (limited to 'src/gui/painting/qdrawhelper_p.h')
| -rw-r--r-- | src/gui/painting/qdrawhelper_p.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/src/gui/painting/qdrawhelper_p.h b/src/gui/painting/qdrawhelper_p.h index d636eabe3f..1c6cd5db8a 100644 --- a/src/gui/painting/qdrawhelper_p.h +++ b/src/gui/painting/qdrawhelper_p.h @@ -329,6 +329,8 @@ struct QSpanData QGradientData gradient; QTextureData texture; }; + QExplicitlySharedDataPointer<const QSharedData> cachedGradient; + void init(QRasterBuffer *rb, const QRasterPaintEngine *pe); void setup(const QBrush &brush, int alpha, QPainter::CompositionMode compositionMode); |