diff options
| author | Marc Mutz <marc.mutz@kdab.com> | 2017-03-21 14:13:34 +0100 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@kdab.com> | 2017-03-22 12:35:13 +0000 |
| commit | 06a7816fa6d7483b85119985b1c45bc8f89e0940 (patch) | |
| tree | e8668629deb1007a6696329eb7ea044500e9d359 /src | |
| parent | e328218dfefc898762db4f9c37b44c61eb8d30e1 (diff) | |
QToolBox: fix potential UB (invalid cast) in Private::_q_widgetDestroyed()
Don't cast an expiring QObject down to QWidget. Cast the QWidgets stored
internally up to QObject to perform the comparison. The result is the
same, but no invalid casts are possible anymore.
Found by independent review.
Change-Id: Iffa8a66cf5cab0270961befe982637ac8e4f0f7b
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
(cherry picked from commit 26bc4ac5cb56ce8f2d3d10125fa9c6a72140573a)
Diffstat (limited to 'src')
| -rw-r--r-- | src/widgets/widgets/qtoolbox.cpp | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/src/widgets/widgets/qtoolbox.cpp b/src/widgets/widgets/qtoolbox.cpp index beb70f1283..7519e70663 100644 --- a/src/widgets/widgets/qtoolbox.cpp +++ b/src/widgets/widgets/qtoolbox.cpp @@ -111,7 +111,7 @@ public: void _q_buttonClicked(); void _q_widgetDestroyed(QObject*); - const Page *page(QWidget *widget) const; + const Page *page(const QObject *widget) const; const Page *page(int index) const; Page *page(int index); @@ -123,7 +123,7 @@ public: Page *currentPage; }; -const QToolBoxPrivate::Page *QToolBoxPrivate::page(QWidget *widget) const +const QToolBoxPrivate::Page *QToolBoxPrivate::page(const QObject *widget) const { if (!widget) return 0; @@ -443,11 +443,9 @@ void QToolBoxPrivate::relayout() void QToolBoxPrivate::_q_widgetDestroyed(QObject *object) { Q_Q(QToolBox); - // no verification - vtbl corrupted already - QWidget *p = (QWidget*)object; - const QToolBoxPrivate::Page *c = page(p); - if (!p || !c) + const QToolBoxPrivate::Page * const c = page(object); + if (!c) return; layout->removeWidget(c->sv); |