diff options
author | Evgeniy A. Dushistov <dushistov@mail.ru> | 2020-08-20 00:33:18 +0300 |
---|---|---|
committer | Ulf Hermann <ulf.hermann@qt.io> | 2020-08-22 18:53:37 +0200 |
commit | b953bd67d4134b9af3e554a0287a462ddf2de5f7 (patch) | |
tree | 81e6b545c8e5a813fa643e8824073ff4e4396f6b /src/qml/qml/qqmlobjectcreator.cpp | |
parent | 3aa4cd682f52b70803cc3f72d732bde9987677dd (diff) |
QQmlObjectCreator: fix member func call with this == nullptr
The test example is based on
qtvirtualkeyboard/src/virtualkeyboard/content/components/PopupList.qml
Luckily ((QQmlPropertyCache *)nullptr) -> property(-1)
is ended without access to this, so this was not caught before.
But this is UB, plus I can not run Qt and my application compiled with
-fsanitizer=X, because of it crashed after the first member function
call with nullptr as this
Fixes: QTBUG-85605
Change-Id: If6a71fde9a14cc4f73139dfa0e6ee3005453104d
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Diffstat (limited to 'src/qml/qml/qqmlobjectcreator.cpp')
-rw-r--r-- | src/qml/qml/qqmlobjectcreator.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/qml/qml/qqmlobjectcreator.cpp b/src/qml/qml/qqmlobjectcreator.cpp index 1142618e2d..5fa0eb281e 100644 --- a/src/qml/qml/qqmlobjectcreator.cpp +++ b/src/qml/qml/qqmlobjectcreator.cpp @@ -1589,7 +1589,7 @@ bool QQmlObjectCreator::populateInstance(int index, QObject *instance, QObject * if (!target) continue; QQmlData *targetDData = QQmlData::get(target, /*create*/false); - if (!targetDData) + if (targetDData == nullptr || targetDData->propertyCache == nullptr) continue; int coreIndex = QQmlPropertyIndex::fromEncoded(alias->encodedMetaPropertyIndex).coreIndex(); QQmlPropertyData *const targetProperty = targetDData->propertyCache->property(coreIndex); |