diff options
author | WooHyun Jung <wh0705.jung@samsung.com> | 2019-12-13 10:33:00 +0900 |
---|---|---|
committer | WooHyun Jung <wh0705.jung@samsung.com> | 2019-12-13 10:33:00 +0900 |
commit | 4efaebfc702c83b128abefa5e4896e37838adedc (patch) | |
tree | 230b9fd7ae50746a30daf82904e38e2726f95982 | |
parent | deb4cc896575caf145a457a429056d8cf9682e9c (diff) | |
download | efl-4efaebfc702c83b128abefa5e4896e37838adedc.tar.gz |
efl_ui_internal_text_interactive: prevent from freed memory accessing
If node_format_remove_pair frees node, then next for loop can lead
invalid memory accessing. This patch prevents from that case by keeping
the next node before freeing.
-rw-r--r-- | src/lib/elementary/efl_ui_internal_text_interactive.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/src/lib/elementary/efl_ui_internal_text_interactive.c b/src/lib/elementary/efl_ui_internal_text_interactive.c index 017f2a884b..a0bbba6469 100644 --- a/src/lib/elementary/efl_ui_internal_text_interactive.c +++ b/src/lib/elementary/efl_ui_internal_text_interactive.c @@ -158,21 +158,25 @@ Eina_Bool _entry_hide_visible_password(Eo *obj) { Eina_Bool b_ret = EINA_FALSE; - const Evas_Object_Textblock_Node_Format *node; + const Evas_Object_Textblock_Node_Format *node, *node_next; node = evas_textblock_node_format_first_get(obj); - for (; node; node = evas_textblock_node_format_next_get(node)) + + if (!node) return EINA_FALSE; + + do { + node_next = evas_textblock_node_format_next_get(node); const char *text = evas_textblock_node_format_text_get(node); if (text) { if (!strcmp(text, "+ password=off")) { - evas_textblock_node_format_remove_pair(obj, - (Evas_Object_Textblock_Node_Format *)node); + evas_textblock_node_format_remove_pair(obj, (Evas_Object_Textblock_Node_Format *)node); b_ret = EINA_TRUE; } } - } + node = node_next; + } while (node); return b_ret; } |