From a81be85b63f8caf817bb7c4a840ff3a3aaf49a83 Mon Sep 17 00:00:00 2001 From: Marc Mutz Date: Mon, 1 Aug 2016 10:05:28 +0300 Subject: QDataWidgetMapper: Fix UB (member call) As found by UBSan: qdatawidgetmapper.cpp:212:59: runtime error: member call on address 0x2b6cc8095be0 which does not point to an object of type 'QFocusHelper' 0x2b6cc8095be0: note: object is of type 'QLineEdit' Just make QDataWidgetMapperPrivate a friend of QWidget. Change-Id: I33d8d430c3a03b7173358d0f96dc7f850d11697c Reviewed-by: Olivier Goffart (Woboq GmbH) Reviewed-by: Friedemann Kleint --- src/widgets/itemviews/qdatawidgetmapper.cpp | 18 ++---------------- src/widgets/kernel/qwidget.h | 1 + 2 files changed, 3 insertions(+), 16 deletions(-) diff --git a/src/widgets/itemviews/qdatawidgetmapper.cpp b/src/widgets/itemviews/qdatawidgetmapper.cpp index ee7b3613a2..058a570437 100644 --- a/src/widgets/itemviews/qdatawidgetmapper.cpp +++ b/src/widgets/itemviews/qdatawidgetmapper.cpp @@ -199,20 +199,6 @@ void QDataWidgetMapperPrivate::_q_commitData(QWidget *w) commit(widgetMap.at(idx)); } -class QFocusHelper: public QWidget -{ -public: - bool focusNextPrevChild(bool next) Q_DECL_OVERRIDE - { - return QWidget::focusNextPrevChild(next); - } - - static inline void focusNextPrevChild(QWidget *w, bool next) - { - static_cast(w)->focusNextPrevChild(next); - } -}; - void QDataWidgetMapperPrivate::_q_closeEditor(QWidget *w, QAbstractItemDelegate::EndEditHint hint) { int idx = findWidget(w); @@ -224,10 +210,10 @@ void QDataWidgetMapperPrivate::_q_closeEditor(QWidget *w, QAbstractItemDelegate: populate(widgetMap[idx]); break; } case QAbstractItemDelegate::EditNextItem: - QFocusHelper::focusNextPrevChild(w, true); + w->focusNextChild(); break; case QAbstractItemDelegate::EditPreviousItem: - QFocusHelper::focusNextPrevChild(w, false); + w->focusPreviousChild(); break; case QAbstractItemDelegate::SubmitModelCache: case QAbstractItemDelegate::NoHint: diff --git a/src/widgets/kernel/qwidget.h b/src/widgets/kernel/qwidget.h index 2af1550ad1..c8e08a5bc4 100644 --- a/src/widgets/kernel/qwidget.h +++ b/src/widgets/kernel/qwidget.h @@ -668,6 +668,7 @@ protected: void destroy(bool destroyWindow = true, bool destroySubWindows = true); + friend class QDataWidgetMapperPrivate; // for access to focusNextPrevChild virtual bool focusNextPrevChild(bool next); inline bool focusNextChild() { return focusNextPrevChild(true); } inline bool focusPreviousChild() { return focusNextPrevChild(false); } -- cgit v1.2.3