AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Ensure null pointers are not added to QXcbConnection::m_touchDevices

Browse Source 
QXcbConnection::touchDeviceForId attempts to retrieve an existing
XInput2TouchDeviceData from m_touchDevices via QHash::operator[]. If
m_touchDevices does not contain the specified XInput2TouchDeviceData,
QHash::operator[] adds a default constructed value (i.e. a null pointer) for
the specified id. This null pointer is not removed from m_touchDevices if
the condition "nrDevices <= 0" is true below. This causes a null pointer
dereference later on in QXcbConnection::finalizeXInput2.

Change-Id: Icd3352417047c4b35d56db2d9f51e3fa1d859e9d
Reviewed-by: Shawn Rutledge <shawn.rutledge@digia.com>
This commit is contained in:
Sandro Mani 2015-02-03 14:12:07 +01:00 committed by Shawn Rutledge
parent 315145ac95
commit 37e7c3afbc
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/plugins/platforms/xcb/qxcbconnection_xi2.cpp
View File

@ -355,8 +355,11 @@ void QXcbConnection::xi2Select(xcb_window_t window)
XInput2TouchDeviceData *QXcbConnection::touchDeviceForId(int id) XInput2TouchDeviceData *QXcbConnection::touchDeviceForId(int id)
{ {
XInput2TouchDeviceData *dev = m_touchDevices[id]; XInput2TouchDeviceData *dev = Q_NULLPTR;
if (!dev) { QHash<int, XInput2TouchDeviceData*>::const_iterator devIt = m_touchDevices.find(id);
if ( devIt != m_touchDevices.end() ) {
dev = devIt.value();
} else {
int nrDevices = 0; int nrDevices = 0;
QTouchDevice::Capabilities caps = 0; QTouchDevice::Capabilities caps = 0;
dev = new XInput2TouchDeviceData; dev = new XInput2TouchDeviceData;
@ -428,7 +431,6 @@ XInput2TouchDeviceData *QXcbConnection::touchDeviceForId(int id)
QWindowSystemInterface::registerTouchDevice(dev->qtTouchDevice); QWindowSystemInterface::registerTouchDevice(dev->qtTouchDevice);
m_touchDevices[id] = dev; m_touchDevices[id] = dev;
} else { } else {
m_touchDevices.remove(id);
XIFreeDeviceInfo(dev->xiDeviceInfo); XIFreeDeviceInfo(dev->xiDeviceInfo);
delete dev; delete dev;
dev = 0; dev = 0;