enlightenment/efl
enlightenment
/
efl
8
7
Fork 15
Code Issues 12 Pull Requests 1 Projects Releases Wiki Activity

edje - signal matcvhes - fix null deref when patterns is NULL 

ok. i found this once-ever-seen thing where
Edje_Signal_Callback_Matches has ALL fields NULL/0 except refcount was
huge (like 13834275 or something like that). i can't see why at the
moment, but defend against it to avoid crashes here by handling these
being null
This commit is contained in:
Carsten Haitzler 2015-08-09 10:29:28 +09:00
parent 7b20430341
commit 761d6fa192
2 changed files with 35 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/lib/edje/edje_program.c
View File

@ -1442,7 +1442,8 @@ _edje_emit_cb(Edje *ed, const char *sig, const char *src, Edje_Message_Signal_Da
ed->walking_callbacks++;
ssp = _edje_signal_callback_patterns_ref(ed->callbacks);
if (ssp)
{
m = (Edje_Signal_Callback_Matches *)ed->callbacks->matches;
EINA_REFCOUNT_REF(m);
@ -1456,8 +1457,7 @@ _edje_emit_cb(Edje *ed, const char *sig, const char *src, Edje_Message_Signal_Da
ed,
prop);
if (!r)
goto break_prog;
if (!r) goto break_prog;
match = edje_match_signal_source_hash_get(sig, src,
ssp->exact_match);
@ -1474,8 +1474,7 @@ _edje_emit_cb(Edje *ed, const char *sig, const char *src, Edje_Message_Signal_Da
cb = &m->matches[*i];
cb->func((void *)ed->callbacks->custom_data[*i], ed->obj, sig, src);
if (_edje_block_break(ed))
break;
if (_edje_block_break(ed)) break;
}
}
@ -1483,6 +1482,7 @@ break_prog:
_edje_signal_callback_matches_unref(m);
_edje_signal_callback_patterns_unref(ssp);
}
ed->walking_callbacks--;

3
src/lib/edje/edje_signal.c
View File

@ -406,8 +406,7 @@ _edje_signal_callback_patterns_ref(const Edje_Signal_Callback_Group *gp)
got_it:
tmp = (Edje_Signal_Callback_Matches *)gp->matches;
EINA_REFCOUNT_REF(tmp->patterns);
if (tmp->patterns) EINA_REFCOUNT_REF(tmp->patterns);
return gp->matches->patterns;
}