From ec495c98189f1d849e793108b09b5af0ce2c8984 Mon Sep 17 00:00:00 2001 From: Kari Oikarinen Date: Wed, 21 Feb 2018 14:44:27 +0200 Subject: Fix use after free in tst_WaylandClient::dontCrashOnMultipleCommits QBackingStore had a pointer to TestWindow window, but it was destroyed only after the TestWindow was already deleted. Change-Id: Id8fe38277cf843d532f2d8c2fdbe1f69d0309a7f Reviewed-by: Johan Helsing --- tests/auto/client/client/tst_client.cpp | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/tests/auto/client/client/tst_client.cpp b/tests/auto/client/client/tst_client.cpp index e244de7f2..eb99b2e2f 100644 --- a/tests/auto/client/client/tst_client.cpp +++ b/tests/auto/client/client/tst_client.cpp @@ -487,19 +487,21 @@ void tst_WaylandClient::dontCrashOnMultipleCommits() QRect rect(QPoint(), window->size()); - QBackingStore backingStore(window); - backingStore.resize(rect.size()); - backingStore.beginPaint(rect); - QPainter p(backingStore.paintDevice()); - p.fillRect(rect, Qt::magenta); - p.end(); - backingStore.endPaint(); - - backingStore.flush(rect); - backingStore.flush(rect); - backingStore.flush(rect); + { + QBackingStore backingStore(window); + backingStore.resize(rect.size()); + backingStore.beginPaint(rect); + QPainter p(backingStore.paintDevice()); + p.fillRect(rect, Qt::magenta); + p.end(); + backingStore.endPaint(); + + backingStore.flush(rect); + backingStore.flush(rect); + backingStore.flush(rect); - compositor->processWaylandEvents(); + compositor->processWaylandEvents(); + } delete window; -- cgit v1.2.3