kimcinoo
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

efl_ui_internal_text_interactive: prevent from freed memory accessing 

If node_format_remove_pair frees node, then next for loop can lead
invalid memory accessing. This patch prevents from that case by keeping
the next node before freeing.
This commit is contained in:
WooHyun Jung 2019-12-13 10:33:00 +09:00
parent deb4cc8965
commit 4efaebfc70
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/lib/elementary/efl_ui_internal_text_interactive.c
View File

@ -158,21 +158,25 @@ Eina_Bool
_entry_hide_visible_password(Eo *obj) _entry_hide_visible_password(Eo *obj)
{ {
Eina_Bool b_ret = EINA_FALSE; Eina_Bool b_ret = EINA_FALSE;
const Evas_Object_Textblock_Node_Format *node; const Evas_Object_Textblock_Node_Format *node, *node_next;
node = evas_textblock_node_format_first_get(obj); node = evas_textblock_node_format_first_get(obj);
for (; node; node = evas_textblock_node_format_next_get(node))
if (!node) return EINA_FALSE;
do
{ {
node_next = evas_textblock_node_format_next_get(node);
const char *text = evas_textblock_node_format_text_get(node); const char *text = evas_textblock_node_format_text_get(node);
if (text) if (text)
{ {
if (!strcmp(text, "+ password=off")) if (!strcmp(text, "+ password=off"))
{ {
evas_textblock_node_format_remove_pair(obj, evas_textblock_node_format_remove_pair(obj, (Evas_Object_Textblock_Node_Format *)node);
(Evas_Object_Textblock_Node_Format *)node);
b_ret = EINA_TRUE; b_ret = EINA_TRUE;
} }
} }
} node = node_next;
} while (node);
return b_ret; return b_ret;
} }