kimcinoo
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

evas - fix access-after-free where during destroy hash item not cleared 

leave it in the hash unfreed as it will be freed when the hash is soon
after durint destruction.

@fix
This commit is contained in:
Carsten Haitzler 2020-01-17 12:14:11 +00:00
parent fbb77e7d1c
commit 3aa250e17f
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/lib/evas/canvas/evas_device.c
View File

@ -108,7 +108,9 @@ _del_cb(void *data, const Efl_Event *ev)
} }
if (devtype == EFL_INPUT_DEVICE_TYPE_MOUSE) if (devtype == EFL_INPUT_DEVICE_TYPE_MOUSE)
_evas_pointer_data_remove(e, ev->object); {
_evas_pointer_data_remove(e, ev->object, EINA_TRUE);
}
eina_hash_del_by_key(e->locks.masks, &ev->object); eina_hash_del_by_key(e->locks.masks, &ev->object);
eina_hash_del_by_key(e->modifiers.masks, &ev->object); eina_hash_del_by_key(e->modifiers.masks, &ev->object);
efl_event_callback_call(e->evas, EFL_CANVAS_SCENE_EVENT_DEVICE_REMOVED, efl_event_callback_call(e->evas, EFL_CANVAS_SCENE_EVENT_DEVICE_REMOVED,
@ -363,7 +365,7 @@ evas_device_class_set(Evas_Device *dev, Evas_Device_Class clas)
return; return;
if (_is_pointer(klass)) if (_is_pointer(klass))
_evas_pointer_data_remove(edata, dev); _evas_pointer_data_remove(edata, dev, EINA_FALSE);
efl_input_device_type_set(dev, clas); efl_input_device_type_set(dev, clas);

4
src/lib/evas/canvas/evas_main.c
View File

@ -1480,7 +1480,7 @@ _evas_pointer_data_add(Evas_Public_Data *edata, Evas_Device *pointer)
} }
void void
_evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer) _evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer, Eina_Bool nofree)
{ {
Evas_Pointer_Data *pdata; Evas_Pointer_Data *pdata;
Evas_Pointer_Seat *pseat; Evas_Pointer_Seat *pseat;
@ -1492,7 +1492,7 @@ _evas_pointer_data_remove(Evas_Public_Data *edata, Evas_Device *pointer)
if (pdata->pointer == pointer) if (pdata->pointer == pointer)
{ {
pseat->pointers = eina_inlist_remove(pseat->pointers, EINA_INLIST_GET(pdata)); pseat->pointers = eina_inlist_remove(pseat->pointers, EINA_INLIST_GET(pdata));
free(pdata); if (!nofree) free(pdata);
hit = pseat; hit = pseat;
break; break;
} }

2
src/lib/evas/include/evas_private.h
View File

@ -1935,7 +1935,7 @@ void _evas_focus_dispatch_event(Evas_Object_Protected_Data *obj,
Efl_Input_Device *seat, Eina_Bool in); Efl_Input_Device *seat, Eina_Bool in);
Evas_Pointer_Data *_evas_pointer_data_by_device_get(Evas_Public_Data *edata, Efl_Input_Device *pointer); Evas_Pointer_Data *_evas_pointer_data_by_device_get(Evas_Public_Data *edata, Efl_Input_Device *pointer);
Evas_Pointer_Data *_evas_pointer_data_add(Evas_Public_Data *edata, Efl_Input_Device *pointer); Evas_Pointer_Data *_evas_pointer_data_add(Evas_Public_Data *edata, Efl_Input_Device *pointer);
void _evas_pointer_data_remove(Evas_Public_Data *edata, Efl_Input_Device *pointer); void _evas_pointer_data_remove(Evas_Public_Data *edata, Efl_Input_Device *pointer, Eina_Bool nofree);
Eina_List *_evas_pointer_list_in_rect_get(Evas_Public_Data *edata, Eina_List *_evas_pointer_list_in_rect_get(Evas_Public_Data *edata,
Evas_Object *obj, Evas_Object *obj,
Evas_Object_Protected_Data *obj_data, Evas_Object_Protected_Data *obj_data,