AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor childIdListForAccessibleObject

Browse Source 
It has several problems:

1. It could potentially create an intArray with uninitialized elements.
   This could happen because the index for getting interfaces were the
   same as the storage index.  This was not correct, because they could
   diverge if iface->child() returned an invalid interface.

2. The count of accessible child elements could change while iterating.
   This could cause out-of-bounds condition when calling
   SetIntArrayRegion as described in QTBUG-45855. Instead now, we call
   SetIntArrayRegion only once, after we have gathered all the child
   interface ids.

Task-number: QTBUG-45855
Change-Id: I77e813158df5f563d04931ac4e296e3fc2a16e67
Reviewed-by: Frederik Gladhorn <frederik.gladhorn@qt.io>
This commit is contained in:
Jan Arve Sæther 2017-10-11 11:35:42 +02:00 committed by Liang Qi
parent 5ec02f7792
commit ecd183455b
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/plugins/platforms/android/androidjniaccessibility.cpp
View File

@ -105,15 +105,15 @@ namespace QtAndroidAccessibility
{
QAccessibleInterface *iface = interfaceFromId(objectId);
if (iface && iface->isValid()) {
jintArray jArray = env->NewIntArray(jsize(iface->childCount()));
for (int i = 0; i < iface->childCount(); ++i) {
const int childCount = iface->childCount();
QVarLengthArray<jint, 8> ifaceIdArray(childCount);
for (int i = 0; i < childCount; ++i) {
QAccessibleInterface *child = iface->child(i);
if (child && child->isValid()) {
QAccessible::Id ifaceId = QAccessible::uniqueId(child);
jint jid = ifaceId;
env->SetIntArrayRegion(jArray, i, 1, &jid);
}
if (child && child->isValid())
ifaceIdArray.append(QAccessible::uniqueId(child));
}
jintArray jArray = env->NewIntArray(jsize(ifaceIdArray.count()));
env->SetIntArrayRegion(jArray, 0, ifaceIdArray.count(), ifaceIdArray.data());
return jArray;
}