From c321349f285913dd32718e74ad48c5972f6d1f87 Mon Sep 17 00:00:00 2001 From: Lorn Potter Date: Fri, 16 Dec 2022 19:03:32 +1000 Subject: wasm: fix heap-use-after-free when using deleteLater MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit QWebSocketPrivate was getting destroyed before the emscripten close callback was getting called, which was then calling back into the already destroyed object. So we set the UnconnectedState before it gets destroyed. Fixes: QTBUG-108996 Pick-to: 6.5 6.4 Change-Id: I8ebbe5a55188a31209a95d2a71eea2faee3465ad Reviewed-by: Morten Johan Sørvig --- src/websockets/qwebsocket_p.cpp | 4 ++++ src/websockets/qwebsocket_wasm_p.cpp | 7 +++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/src/websockets/qwebsocket_p.cpp b/src/websockets/qwebsocket_p.cpp index 5ee1b45..dfb06ee 100644 --- a/src/websockets/qwebsocket_p.cpp +++ b/src/websockets/qwebsocket_p.cpp @@ -178,6 +178,10 @@ void QWebSocketPrivate::init() */ QWebSocketPrivate::~QWebSocketPrivate() { +#ifdef Q_OS_WASM + if (m_socketContext) + emscripten_websocket_delete(m_socketContext); +#endif } /*! diff --git a/src/websockets/qwebsocket_wasm_p.cpp b/src/websockets/qwebsocket_wasm_p.cpp index 4255203..31ea6a5 100644 --- a/src/websockets/qwebsocket_wasm_p.cpp +++ b/src/websockets/qwebsocket_wasm_p.cpp @@ -111,14 +111,14 @@ void QWebSocketPrivate::close(QWebSocketProtocol::CloseCode closeCode, QString r Q_EMIT q->aboutToClose(); setSocketState(QAbstractSocket::ClosingState); - emscripten_websocket_get_ready_state(m_socketContext, &m_readyState); if (m_readyState == 1) { emscripten_websocket_close(m_socketContext, (int)closeCode, reason.toUtf8()); } + setSocketState(QAbstractSocket::UnconnectedState); + emit q->disconnected(); emscripten_websocket_get_ready_state(m_socketContext, &m_readyState); - } void QWebSocketPrivate::open(const QNetworkRequest &request, @@ -242,8 +242,7 @@ void QWebSocketPrivate::setSocketClosed(const EmscriptenWebSocketCloseEvent *emC m_errorString = QStringLiteral("The remote host closed the connection"); emit q->error(error()); } - setSocketState(QAbstractSocket::UnconnectedState); - emit q->disconnected(); + emscripten_websocket_get_ready_state(m_socketContext, &m_readyState); if (m_readyState == 3) { // closed -- cgit v1.2.1