kimcinoo
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

efl_ui_internal_text_interactive: prevent from freed memory accessing 

If node_format_remove_pair frees node, then next for loop can lead
invalid memory accessing. This patch prevents from that case by keeping
the next node before freeing.
This commit is contained in:
WooHyun Jung 2019-12-13 10:33:00 +09:00
parent deb4cc8965
commit 4efaebfc70
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/lib/elementary/efl_ui_internal_text_interactive.c
View File

@ -158,21 +158,25 @@ Eina_Bool
_entry_hide_visible_password(Eo *obj)
{
Eina_Bool b_ret = EINA_FALSE;
const Evas_Object_Textblock_Node_Format *node;
const Evas_Object_Textblock_Node_Format *node, *node_next;
node = evas_textblock_node_format_first_get(obj);
for (; node; node = evas_textblock_node_format_next_get(node))
if (!node) return EINA_FALSE;
do
{
node_next = evas_textblock_node_format_next_get(node);
const char *text = evas_textblock_node_format_text_get(node);
if (text)
{
if (!strcmp(text, "+ password=off"))
{
evas_textblock_node_format_remove_pair(obj,
(Evas_Object_Textblock_Node_Format *)node);
evas_textblock_node_format_remove_pair(obj, (Evas_Object_Textblock_Node_Format *)node);
b_ret = EINA_TRUE;
}
}
}
node = node_next;
} while (node);
return b_ret;
}