From 51cf4215dc0777d0ed57e973c8343549f217bf54 Mon Sep 17 00:00:00 2001
From: Frederik Gladhorn <frederik.gladhorn@digia.com>
Date: Tue, 11 Dec 2012 20:31:00 +0100
Subject: [PATCH] Accessibility Linux: Prevent access to invalid interfaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Especially with the newer QML accessibility we
can end up with events for objects that cannot
instantiate a QAccessibleInterface.
Let's not crash in that case.

Change-Id: Ie5d38315f32d30540eb4adcb74a7b3bfa667f03f
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Reviewed-by: Morten Johan Sørvig <morten.sorvig@digia.com>
---
 .../linuxaccessibility/atspiadaptor.cpp       | 25 +++++++++++++++----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/platformsupport/linuxaccessibility/atspiadaptor.cpp b/src/platformsupport/linuxaccessibility/atspiadaptor.cpp
index 66541e6a61..0db8e31537 100644
--- a/src/platformsupport/linuxaccessibility/atspiadaptor.cpp
+++ b/src/platformsupport/linuxaccessibility/atspiadaptor.cpp
@@ -971,7 +971,10 @@ void AtSpiAdaptor::notify(QAccessibleEvent *event)
     case QAccessible::TextUpdated: {
         if (sendObject || sendObject_text_changed) {
             QAIPointer iface = QAIPointer(event->accessibleInterface());
-            Q_ASSERT(iface->textInterface());
+            if (!iface || !iface->textInterface()) {
+                qAtspiDebug() << "Received text event for invalid interface.";
+                return;
+            }
             QString path = pathForInterface(iface);
 
             int changePosition = 0;
@@ -1026,8 +1029,8 @@ void AtSpiAdaptor::notify(QAccessibleEvent *event)
     case QAccessible::TextCaretMoved: {
         if (sendObject || sendObject_text_caret_moved) {
             QAIPointer iface = QAIPointer(event->accessibleInterface());
-            if (!iface->textInterface()) {
-                qWarning() << "Sending TextCaretMoved from object that does not implement text interface: " << iface << iface->object();
+            if (!iface || !iface->textInterface()) {
+                qWarning() << "Sending TextCaretMoved from object that does not implement text interface: " << iface;
                 return;
             }
 
@@ -1054,7 +1057,11 @@ void AtSpiAdaptor::notify(QAccessibleEvent *event)
     case QAccessible::ValueChanged: {
         if (sendObject || sendObject_value_changed || sendObject_property_change_accessible_value) {
             QAIPointer iface = QAIPointer(event->accessibleInterface());
-            Q_ASSERT(iface->valueInterface());
+            if (!iface || !iface->valueInterface()) {
+                qWarning() << "ValueChanged event from invalid accessible: " << iface;
+                return;
+            }
+
             QString path = pathForInterface(iface);
             QVariantList args = packDBusSignalArguments(QLatin1String("accessible-value"), 0, 0, variantForPath(path));
             sendDBusSignal(path, QLatin1String(ATSPI_DBUS_INTERFACE_EVENT_OBJECT),
@@ -1064,6 +1071,10 @@ void AtSpiAdaptor::notify(QAccessibleEvent *event)
     }
     case QAccessible::Selection: {
         QAIPointer iface = QAIPointer(event->accessibleInterface());
+        if (!iface) {
+            qWarning() << "Selection event from invalid accessible.";
+            return;
+        }
         QString path = pathForInterface(iface);
         int selected = iface->state().selected ? 1 : 0;
         QVariantList stateArgs = packDBusSignalArguments(QLatin1String("selected"), selected, 0, variantForPath(path));
@@ -1077,11 +1088,15 @@ void AtSpiAdaptor::notify(QAccessibleEvent *event)
             QAccessible::State stateChange = static_cast<QAccessibleStateChangeEvent*>(event)->changedStates();
             if (stateChange.checked) {
                 QAIPointer iface = QAIPointer(event->accessibleInterface());
+                if (!iface) {
+                    qWarning() << "StateChanged event from invalid accessible.";
+                    return;
+                }
                 int checked = iface->state().checked;
                 notifyStateChange(iface, QLatin1String("checked"), checked);
             } else if (stateChange.active) {
                 QAIPointer iface = QAIPointer(event->accessibleInterface());
-                if (!(iface->role() == QAccessible::Window && (sendWindow || sendWindow_activate)))
+                if (!iface || !(iface->role() == QAccessible::Window && (sendWindow || sendWindow_activate)))
                     return;
                 QString windowTitle = iface->text(QAccessible::Name);
                 QDBusVariant data;