enlightenment/efl
enlightenment
/
efl
8
7
Fork 14
Code Issues 13 Pull Requests 3 Projects Releases Wiki Activity

evas - fix access-after-free where during destroy hash item not cleared 

leave it in the hash unfreed as it will be freed when the hash is soon
after durint destruction.

@fix
This commit is contained in:
Carsten Haitzler 2020-01-17 12:14:11 +00:00
parent fbb77e7d1c
commit 3aa250e17f
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/lib/evas/canvas/evas_device.c
View File

@ -108,7 +108,9 @@ _del_cb(void *data, const Efl_Event *ev)
}
if (devtype == EFL_INPUT_DEVICE_TYPE_MOUSE)
_evas_pointer_data_remove(e, ev->object);
{
_evas_pointer_data_remove(e, ev->object, EINA_TRUE);
}
eina_hash_del_by_key(e->locks.masks, &ev->object);
eina_hash_del_by_key(e->modifiers.masks, &ev->object);
efl_event_callback_call(e->evas, EFL_CANVAS_SCENE_EVENT_DEVICE_REMOVED,
@ -363,7 +365,7 @@ evas_device_class_set(Evas_Device *dev, Evas_Device_Class clas)
return;
if (_is_pointer(klass))
_evas_pointer_data_remove(edata, dev);
_evas_pointer_data_remove(edata, dev, EINA_FALSE);
efl_input_device_type_set(dev, clas);

4
src/lib/evas/canvas/evas_main.c
View File

@ -1480,7 +1480,7 @@ _evas_pointer_data_add(Evas_Public_Data *edata, Evas_Device *pointer)
}
void
_evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer)
_evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer, Eina_Bool nofree)
{
Evas_Pointer_Data *pdata;
Evas_Pointer_Seat *pseat;
@ -1492,7 +1492,7 @@ _evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer)
if (pdata->pointer == pointer)
{
pseat->pointers = eina_inlist_remove(pseat->pointers, EINA_INLIST_GET(pdata));
free(pdata);
if (!nofree) free(pdata);
hit = pseat;
break;
}

2
src/lib/evas/include/evas_private.h
View File

@ -1935,7 +1935,7 @@ void _evas_focus_dispatch_event(Evas_Object_Protected_Data *obj,
Efl_Input_Device *seat, Eina_Bool in);
Evas_Pointer_Data *_evas_pointer_data_by_device_get(Evas_Public_Data *edata, Efl_Input_Device *pointer);
Evas_Pointer_Data *_evas_pointer_data_add(Evas_Public_Data *edata, Efl_Input_Device *pointer);
void _evas_pointer_data_remove(Evas_Public_Data *edata, Efl_Input_Device *pointer);
void _evas_pointer_data_remove(Evas_Public_Data *edata, Efl_Input_Device *pointer, Eina_Bool nofree);
Eina_List *_evas_pointer_list_in_rect_get(Evas_Public_Data *edata,
Evas_Object *obj,
Evas_Object_Protected_Data *obj_data,