QAbstractSocket - protect against the broken invariant

It's possible to use QAbstractSocket (more precisely QUdpSocket) in
a quite unusual way: connect to its stateChanged() signal and call
close() in the slot (thus invalidating socketEngine pointer). For
QAbstractSocket::bind() this results in a null-pointer
dereference.

Task-number: QTBUG-69063
Change-Id: Ife2c778ff59ccc7b99a96caa5ba67f877aaefe42
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>

1 files changed, 4 insertions, 1 deletions

diff --git a/src/network/socket/qabstractsocket.cpp b/src/network/socket/qabstractsocket.cpp
index 13e10e4102..4d9fda00ce 100644
--- a/src/network/socket/qabstractsocket.cpp
+++ b/src/network/socket/qabstractsocket.cpp
@@ -1609,7 +1609,10 @@ bool QAbstractSocketPrivate::bind(const QHostAddress &address, quint16 port, QAb
     localPort = socketEngine->localPort();
 
     emit q->stateChanged(state);
-    if (socketType == QAbstractSocket::UdpSocket)
+    // A slot attached to stateChanged() signal can break our invariant:
+    // by closing the socket it will reset its socket engine - thus we
+    // have additional check (isValid()) ...
+    if (q->isValid() && socketType == QAbstractSocket::UdpSocket)
         socketEngine->setReadNotificationEnabled(true);
     return true;
 }