diff options
| author | Marc Mutz <marc.mutz@kdab.com> | 2017-03-21 14:13:34 +0100 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@kdab.com> | 2017-03-21 14:30:31 +0000 |
| commit | 26bc4ac5cb56ce8f2d3d10125fa9c6a72140573a (patch) | |
| tree | 999775166ad487836a28d4d7f6a3bc326805757c /src/widgets | |
| parent | 05924ddff901671063337f6e0e4bb84c915097ef (diff) | |
QToolBox: fix potential UB (invalid cast) in Private::_q_widgetDestroyed()
Don't cast an expiring QObject down to QWidget. Cast the QWidgets stored
internally up to QObject to perform the comparison. The result is the
same, but no invalid casts are possible anymore.
Found by independent review.
Change-Id: Iffa8a66cf5cab0270961befe982637ac8e4f0f7b
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
Diffstat (limited to 'src/widgets')
| -rw-r--r-- | src/widgets/widgets/qtoolbox.cpp | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/src/widgets/widgets/qtoolbox.cpp b/src/widgets/widgets/qtoolbox.cpp index 2c74b5fa9d..8413827e30 100644 --- a/src/widgets/widgets/qtoolbox.cpp +++ b/src/widgets/widgets/qtoolbox.cpp @@ -117,7 +117,7 @@ public: void _q_buttonClicked(); void _q_widgetDestroyed(QObject*); - const Page *page(QWidget *widget) const; + const Page *page(const QObject *widget) const; const Page *page(int index) const; Page *page(int index); @@ -129,7 +129,7 @@ public: Page *currentPage; }; -const QToolBoxPrivate::Page *QToolBoxPrivate::page(QWidget *widget) const +const QToolBoxPrivate::Page *QToolBoxPrivate::page(const QObject *widget) const { if (!widget) return 0; @@ -449,11 +449,9 @@ void QToolBoxPrivate::relayout() void QToolBoxPrivate::_q_widgetDestroyed(QObject *object) { Q_Q(QToolBox); - // no verification - vtbl corrupted already - QWidget *p = (QWidget*)object; - const QToolBoxPrivate::Page *c = page(p); - if (!p || !c) + const QToolBoxPrivate::Page * const c = page(object); + if (!c) return; layout->removeWidget(c->sv); |