diff options
| author | Jesus Fernandez <jesus.fernandez@qt.io> | 2017-10-24 19:05:18 +0200 |
|---|---|---|
| committer | Jesus Fernandez <Jesus.Fernandez@qt.io> | 2017-10-24 18:21:34 +0000 |
| commit | 112540645d78000ad8dfed1bca6662a10522aaf1 (patch) | |
| tree | 4b853194dc8e42c29507a729503a99610e0b1132 | |
| parent | 81eb502b85008c8d50c2e0c947ae59fcf9263f00 (diff) | |
| download | qttools-112540645d78000ad8dfed1bca6662a10522aaf1.tar.gz | |
Fix use after free
This could cause an immediate crash or incorrect values might be read
subsequently resulting in incorrect computations.
In
QtVariantPropertyManagerPrivate::​removeSubProperty(QtVariantProperty
*): A pointer to freed memory is dereferenced, used as a function
argument, or otherwise used (CWE-416)
Coverity-Id: 22144
Change-Id: I0cd9c37769470e9c6f3d50fb53666b7db3e03c62
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
| -rw-r--r-- | src/shared/qtpropertybrowser/qtvariantproperty.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/shared/qtpropertybrowser/qtvariantproperty.cpp b/src/shared/qtpropertybrowser/qtvariantproperty.cpp index 51a2f2cf9..8861e988c 100644 --- a/src/shared/qtpropertybrowser/qtvariantproperty.cpp +++ b/src/shared/qtpropertybrowser/qtvariantproperty.cpp @@ -414,10 +414,10 @@ void QtVariantPropertyManagerPrivate::removeSubProperty(QtVariantProperty *prope QtProperty *internChild = wrappedProperty(property); bool wasDestroyingSubProperties = m_destroyingSubProperties; m_destroyingSubProperties = true; - delete property; m_destroyingSubProperties = wasDestroyingSubProperties; m_internalToProperty.remove(internChild); propertyToWrappedProperty()->remove(property); + delete property; } void QtVariantPropertyManagerPrivate::slotPropertyInserted(QtProperty *property, |