From d8e784f47e2d6e85680455e088e7348b9f6b376c Mon Sep 17 00:00:00 2001
From: Frederik Gladhorn <frederik.gladhorn@digia.com>
Date: Mon, 4 Mar 2013 23:55:52 +0100
Subject: Fix potential crash in accessibility key event handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: Id3eec6c83d7f8ece186e6b5bc02771c00893294b
Reviewed-by: Jan Arve Sæther <jan-arve.saether@digia.com>
---
 src/platformsupport/linuxaccessibility/application.cpp | 14 ++++++++------
 src/platformsupport/linuxaccessibility/application_p.h |  3 ++-
 2 files changed, 10 insertions(+), 7 deletions(-)

(limited to 'src')

diff --git a/src/platformsupport/linuxaccessibility/application.cpp b/src/platformsupport/linuxaccessibility/application.cpp
index 6e826e4432..5c8f2e5fe2 100644
--- a/src/platformsupport/linuxaccessibility/application.cpp
+++ b/src/platformsupport/linuxaccessibility/application.cpp
@@ -174,7 +174,7 @@ bool QSpiApplicationAdaptor::eventFilter(QObject *target, QEvent *event)
                         SLOT(notifyKeyboardListenerError(QDBusError, QDBusMessage)), timeout);
         if (sent) {
             //queue the event and send it after callback
-            keyEvents.enqueue(QPair<QObject*, QKeyEvent*> (target, copyKeyEvent(keyEvent)));
+            keyEvents.enqueue(QPair<QPointer<QObject>, QKeyEvent*> (QPointer<QObject>(target), copyKeyEvent(keyEvent)));
 #ifdef KEYBOARD_DEBUG
             qDebug() << QStringLiteral("Sent key: ") << de.text;
 #endif
@@ -200,11 +200,12 @@ void QSpiApplicationAdaptor::notifyKeyboardListenerCallback(const QDBusMessage&
     }
     Q_ASSERT(message.arguments().length() == 1);
     if (message.arguments().at(0).toBool() == true) {
-        QPair<QObject*, QKeyEvent*> event = keyEvents.dequeue();
+        QPair<QPointer<QObject>, QKeyEvent*> event = keyEvents.dequeue();
         delete event.second;
     } else {
-        QPair<QObject*, QKeyEvent*> event = keyEvents.dequeue();
-        QCoreApplication::postEvent(event.first, event.second);
+        QPair<QPointer<QObject>, QKeyEvent*> event = keyEvents.dequeue();
+        if (event.first)
+            QCoreApplication::postEvent(event.first.data(), event.second);
     }
 }
 
@@ -212,8 +213,9 @@ void QSpiApplicationAdaptor::notifyKeyboardListenerError(const QDBusError& error
 {
     qWarning() << QStringLiteral("QSpiApplication::keyEventError ") << error.name() << error.message();
     while (!keyEvents.isEmpty()) {
-        QPair<QObject*, QKeyEvent*> event = keyEvents.dequeue();
-        QCoreApplication::postEvent(event.first, event.second);
+        QPair<QPointer<QObject>, QKeyEvent*> event = keyEvents.dequeue();
+        if (event.first)
+            QCoreApplication::postEvent(event.first.data(), event.second);
     }
 }
 
diff --git a/src/platformsupport/linuxaccessibility/application_p.h b/src/platformsupport/linuxaccessibility/application_p.h
index 9b6763f111..754d98495a 100644
--- a/src/platformsupport/linuxaccessibility/application_p.h
+++ b/src/platformsupport/linuxaccessibility/application_p.h
@@ -42,6 +42,7 @@
 #ifndef Q_SPI_APPLICATION_H
 #define Q_SPI_APPLICATION_H
 
+#include <QtCore/QPointer>
 #include <QtCore/QQueue>
 #include <QtDBus/QDBusConnection>
 #include <QtGui/QAccessibleInterface>
@@ -76,7 +77,7 @@ private Q_SLOTS:
 private:
     static QKeyEvent* copyKeyEvent(QKeyEvent*);
 
-    QQueue<QPair<QObject*, QKeyEvent*> > keyEvents;
+    QQueue<QPair<QPointer<QObject>, QKeyEvent*> > keyEvents;
     QDBusConnection dbusConnection;
 };
 
-- 
cgit v1.2.3