diff options
| author | Alexandru Croitor <alexandru.croitor@theqtcompany.com> | 2016-03-30 18:22:21 +0200 |
|---|---|---|
| committer | Alexandru Croitor <alexandru.croitor@theqtcompany.com> | 2016-04-01 15:08:24 +0000 |
| commit | b98d79b561791459dd6bfb0fed5dc7462a1a09a7 (patch) | |
| tree | 9a1a43746a1db6e9ff114eee39a471dd97c45cfe /src/webenginewidgets/api/qwebenginefullscreenrequest.cpp | |
| parent | 82900c7b96b2a6fb42fe3841df7685b820edd588 (diff) | |
Fix crashes due to qputenv being called after Chromium initialization.
The qputenv() call inside gl_surface_qt.cpp, which is executed on a
GpuChildThread, can reallocate the process environment structure,
and it is possible that at the same time the main thread calls getenv,
which will dereference a pointer to the freed environment structure,
essentially causing a use-after-free crash.
Make sure the qputenv() call happens before Chromium initialization
starts, so no thread-race can occur.
Change-Id: I4ecbdc8bf2abbe45f7d6c5d2633dc9fe27f51e66
Task-number: QTBUG-52124
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
Reviewed-by: Kai Koehne <kai.koehne@theqtcompany.com>
(cherry picked from commit 76c61aa1400ef2def204c3732e30e08e40631e8d)
Diffstat (limited to 'src/webenginewidgets/api/qwebenginefullscreenrequest.cpp')
0 files changed, 0 insertions, 0 deletions