evas: Replace EINA_LIST_FOREACH_SAFE to while statement.
Clipees can be cleared before the loop is finished because evas_object_clip_unset calls smart function of clip_unset. So, if we use EINA_LIST_FOREACH_SAFE, invalid next list pointer can be kept and read after obj->clip.clipees is freed. Thanks to Davide Andreoli for reporting. @fix
This commit is contained in:
parent
1b2f732d2a
commit
2791c3dc06
|
@ -621,7 +621,6 @@ _destructor(Eo *eo_obj, void *_pd, va_list *list EINA_UNUSED)
|
||||||
return;
|
return;
|
||||||
MAGIC_CHECK_END();
|
MAGIC_CHECK_END();
|
||||||
Evas_Object_Protected_Data *obj = _pd;
|
Evas_Object_Protected_Data *obj = _pd;
|
||||||
Evas_Object_Protected_Data *tmp;
|
|
||||||
Evas_Object *proxy;
|
Evas_Object *proxy;
|
||||||
Eina_List *l, *l2;
|
Eina_List *l, *l2;
|
||||||
|
|
||||||
|
@ -654,8 +653,14 @@ _destructor(Eo *eo_obj, void *_pd, va_list *list EINA_UNUSED)
|
||||||
goto end;
|
goto end;
|
||||||
}
|
}
|
||||||
evas_object_grabs_cleanup(eo_obj, obj);
|
evas_object_grabs_cleanup(eo_obj, obj);
|
||||||
EINA_LIST_FOREACH_SAFE(obj->clip.clipees, l, l2, tmp)
|
/* "while" should be used for null check of obj->clip.clipees,
|
||||||
evas_object_clip_unset(tmp->object);
|
because evas_objct_clip_unset can set null to obj->clip.clipees */
|
||||||
|
while (obj->clip.clipees)
|
||||||
|
{
|
||||||
|
Evas_Object_Protected_Data *tmp;
|
||||||
|
tmp = eina_list_data_get(obj->clip.clipees);
|
||||||
|
evas_object_clip_unset(tmp->object);
|
||||||
|
}
|
||||||
EINA_LIST_FOREACH_SAFE(obj->proxy->proxies, l, l2, proxy)
|
EINA_LIST_FOREACH_SAFE(obj->proxy->proxies, l, l2, proxy)
|
||||||
{
|
{
|
||||||
if (eo_isa(proxy, EVAS_OBJ_IMAGE_CLASS))
|
if (eo_isa(proxy, EVAS_OBJ_IMAGE_CLASS))
|
||||||
|
|
Loading…
Reference in New Issue