summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWooHyun Jung <wh0705.jung@samsung.com>2019-12-13 10:33:00 +0900
committerWooHyun Jung <wh0705.jung@samsung.com>2019-12-13 10:33:00 +0900
commit4efaebfc702c83b128abefa5e4896e37838adedc (patch)
tree230b9fd7ae50746a30daf82904e38e2726f95982
parentdeb4cc896575caf145a457a429056d8cf9682e9c (diff)
efl_ui_internal_text_interactive: prevent from freed memory accessing
If node_format_remove_pair frees node, then next for loop can lead invalid memory accessing. This patch prevents from that case by keeping the next node before freeing.
-rw-r--r--src/lib/elementary/efl_ui_internal_text_interactive.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/src/lib/elementary/efl_ui_internal_text_interactive.c b/src/lib/elementary/efl_ui_internal_text_interactive.c
index 017f2a884b..a0bbba6469 100644
--- a/src/lib/elementary/efl_ui_internal_text_interactive.c
+++ b/src/lib/elementary/efl_ui_internal_text_interactive.c
@@ -158,21 +158,25 @@ Eina_Bool
158_entry_hide_visible_password(Eo *obj) 158_entry_hide_visible_password(Eo *obj)
159{ 159{
160 Eina_Bool b_ret = EINA_FALSE; 160 Eina_Bool b_ret = EINA_FALSE;
161 const Evas_Object_Textblock_Node_Format *node; 161 const Evas_Object_Textblock_Node_Format *node, *node_next;
162 node = evas_textblock_node_format_first_get(obj); 162 node = evas_textblock_node_format_first_get(obj);
163 for (; node; node = evas_textblock_node_format_next_get(node)) 163
164 if (!node) return EINA_FALSE;
165
166 do
164 { 167 {
168 node_next = evas_textblock_node_format_next_get(node);
165 const char *text = evas_textblock_node_format_text_get(node); 169 const char *text = evas_textblock_node_format_text_get(node);
166 if (text) 170 if (text)
167 { 171 {
168 if (!strcmp(text, "+ password=off")) 172 if (!strcmp(text, "+ password=off"))
169 { 173 {
170 evas_textblock_node_format_remove_pair(obj, 174 evas_textblock_node_format_remove_pair(obj, (Evas_Object_Textblock_Node_Format *)node);
171 (Evas_Object_Textblock_Node_Format *)node);
172 b_ret = EINA_TRUE; 175 b_ret = EINA_TRUE;
173 } 176 }
174 } 177 }
175 } 178 node = node_next;
179 } while (node);
176 180
177 return b_ret; 181 return b_ret;
178} 182}