summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKateryna Fesyna <k.fesyna@samsung.com>2014-11-06 06:18:34 +0100
committerCedric BAIL <cedric@osg.samsung.com>2014-11-06 06:18:38 +0100
commit8ceef8c6ca12b00698c7cd13394fba1de8e4c6b7 (patch)
tree74d7816d47961ca69be47f451627c52755ac31f4
parent41ea6e81d6aa74d5cb93122899ba7da2d25309fb (diff)
edje: Edje_Edit - fix segfault on copying state of IMAGE part with twins
Summary: The copying of state of IMAGE part with twins caused the sefmentation fault due to the extra memory freing in _edje_edit_part_state_copy() that is deleted with this commit. The data that is freed was previously copied from the structure of state 'from' and freeing of this data leads to freeing data of 'from' part. Later, on copying of tweens to 'to' state array of tweens appears segmentation fault because we try to access freed data of 'from' state. @fix Reviewers: cedric, Hermet, raster, seoz Subscribers: cedric, reutskiy.v.v Differential Revision: https://phab.enlightenment.org/D1636 Signed-off-by: Cedric BAIL <cedric@osg.samsung.com>
-rw-r--r--src/lib/edje/edje_edit.c6
1 files changed, 0 insertions, 6 deletions
diff --git a/src/lib/edje/edje_edit.c b/src/lib/edje/edje_edit.c
index b7247acd3b..5b952b06f8 100644
--- a/src/lib/edje/edje_edit.c
+++ b/src/lib/edje/edje_edit.c
@@ -5085,12 +5085,6 @@ _edje_edit_part_state_copy(Evas_Object *obj, const char *part, const char *part_
5085 5085
5086 img_to->image = img_from->image; 5086 img_to->image = img_from->image;
5087 5087
5088 /* Update pointers. */
5089 for (i = 0; i < img_to->image.tweens_count; ++i)
5090 free(img_to->image.tweens[i]);
5091 if (img_to->image.tweens_count > 0)
5092 free(img_to->image.tweens);
5093
5094 img_to->image.tweens_count = img_from->image.tweens_count; 5088 img_to->image.tweens_count = img_from->image.tweens_count;
5095 img_to->image.tweens = calloc(img_to->image.tweens_count, 5089 img_to->image.tweens = calloc(img_to->image.tweens_count,
5096 sizeof (Edje_Part_Image_Id*)); 5090 sizeof (Edje_Part_Image_Id*));