SelectionListModel: Fix use after free

Calling InputEngine::setInputMethod(null) did not clear the pointer
value stored in SelectionListModelPrivate.

Also, in case the input method is destroyed without setting it null,
prevent use of dangling pointer in selection list model by using
QPointer.

Task-number: QTBUG-61308
Change-Id: If340d99a63489c54414497c61cd482e06a21c5ee
Reviewed-by: Mitch Curtis <mitch.curtis@qt.io>

2 files changed, 3 insertions, 3 deletions

diff --git a/src/virtualkeyboard/inputengine.cpp b/src/virtualkeyboard/inputengine.cpp
index 7965f06d..f15eee26 100644
--- a/src/virtualkeyboard/inputengine.cpp
+++ b/src/virtualkeyboard/inputengine.cpp
@@ -375,9 +375,8 @@ void InputEngine::setInputMethod(AbstractInputMethod *inputMethod)
 
             // Set current text case
             d->inputMethod->setTextCase(d->textCase);
-
-            updateSelectionListModels();
         }
+        updateSelectionListModels();
         emit inputMethodChanged();
         emit inputModesChanged();
         emit patternRecognitionModesChanged();
diff --git a/src/virtualkeyboard/selectionlistmodel.cpp b/src/virtualkeyboard/selectionlistmodel.cpp
index 7606a1c6..78316465 100644
--- a/src/virtualkeyboard/selectionlistmodel.cpp
+++ b/src/virtualkeyboard/selectionlistmodel.cpp
@@ -31,6 +31,7 @@
 #include "abstractinputmethod.h"
 #include "settings.h"
 #include <QtCore/private/qabstractitemmodel_p.h>
+#include <QtCore/qpointer.h>
 
 namespace QtVirtualKeyboard {
 
@@ -47,7 +48,7 @@ public:
     }
 
     QHash<int, QByteArray> roles;
-    AbstractInputMethod *dataSource;
+    QPointer<AbstractInputMethod> dataSource;
     SelectionListModel::Type type;
     int rowCount;
     bool wclAutoCommitWord;