AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QWidget: Fix UB (invalid cast) in sendResizeEvents()

Browse Source 
Found by UBSan:

  qwidget.cpp:5228:62: runtime error: downcast of address 0x61b00003d480 which does not point to an object of type 'QWidget'
  0x61b00003d480: note: object is of type 'QMainWindowLayout'
   bc 00 00 75  90 2e 2a 78 4f 2b 00 00  40 c1 02 00 f0 60 00 00  78 2f 2a 78 4f 2b 00 00  00 00 00 00
                ^~~~~~~~~~~~~~~~~~~~~~~
                vptr for 'QMainWindowLayout'
    #0 0x2b4f70efb1c2 in sendResizeEvents qwidget.cpp:5228
    #1 0x2b4f70f65f7f in QWidget::grab(QRect const&) qwidget.cpp:5252
    #2 0x6b1746 in tst_QWidget::render_task188133() tst_qwidget.cpp:6615

Fix by performing the cast only after the test for isWidgetType() has
succeeded.

Change-Id: I061a60ef35bcb5fbefb9bc7b84706c9dd5afd207
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This commit is contained in:
Marc Mutz 2016-09-27 13:41:55 +02:00
parent 5571d2bf62
commit c65621b362
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/widgets/kernel/qwidget.cpp
View File

@ -5201,8 +5201,10 @@ static void sendResizeEvents(QWidget *target)
const QObjectList children = target->children();
for (int i = 0; i < children.size(); ++i) {
if (!children.at(i)->isWidgetType())
continue;
QWidget *child = static_cast<QWidget*>(children.at(i));
if (child->isWidgetType() && !child->isWindow() && child->testAttribute(Qt::WA_PendingResizeEvent))
if (!child->isWindow() && child->testAttribute(Qt::WA_PendingResizeEvent))
sendResizeEvents(child);
}
}