diff options
author | Eduardo M. Fleury <eduardo.fleury@openbossa.org> | 2009-11-27 18:38:48 (GMT) |
---|---|---|
committer | Eduardo M. Fleury <eduardo.fleury@openbossa.org> | 2009-11-27 19:18:11 (GMT) |
commit | b70256432c2393afb5686c9ef61e38ff399be954 (patch) | |
tree | 2b5eaddc516d9215a8b95c19f99a856af89d6241 /tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp | |
parent | 5b9d7f05aa369c07c2f498280d8a8b9c81f7aff1 (diff) | |
download | Qt-b70256432c2393afb5686c9ef61e38ff399be954.zip Qt-b70256432c2393afb5686c9ef61e38ff399be954.tar.gz Qt-b70256432c2393afb5686c9ef61e38ff399be954.tar.bz2 |
QGAL: Fix memory management issues (leak + invalid read)
Fixing QGraphicsAnchor memory leak and access to free'd region.
-- Leak:
User-created anchors have two representations in QGAL, one
visible externally (QGraphicsAnchor) and other internal (AnchorData).
When such anchors are removed externally (QGraphicsAnchor is deleted),
the former implementation ensured that the internal representation
would be deleted too. However the opposite was not true. In cases
where the anchors are deleted internally (in the layout destructor,
for instance, or when an item is removed through the removeAt API),
the public QGraphicsAnchor object would leak.
This commit ensures the deletion will happen in both directions
and adds protection to avoid a deletion loop.
-- Invalid read:
In QGAL::removeAnchor(vertex1, vertex2), we read vertex information
after calling removeAnchor_helper(vertex1, vertex2).
The problem is that in cases where the removed anchor is the last
anchor to connect to a center vertex, its removal will cause also
the removal of such vertex. Thus, accessing the vertices after
the removeAnchor_helper() call is unsafe.
To solve that we cache the information we need and then clear the
vertex pointers to avoid errors in the future.
Signed-off-by: Eduardo M. Fleury <eduardo.fleury@openbossa.org>
Reviewed-by: Artur Duque de Souza <artur.souza@openbossa.org>
Diffstat (limited to 'tests/auto/qgraphicsanchorlayout/tst_qgraphicsanchorlayout.cpp')
0 files changed, 0 insertions, 0 deletions