timer23
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

evas: Fix double free in post events 

A use of the post event callback in Bryce triggered a double free
as an event was being processed but not yet removed from its list,
leading to an invalid state of the Eina_List.

Also remove obj from struct as it is unused.

Fixes T5157
This commit is contained in:
Jean-Philippe Andre 2017-02-14 14:42:33 +09:00
parent 45d846814f
commit 65ae1c812c
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/lib/evas/canvas/evas_callbacks.c
View File

@ -225,6 +225,7 @@ void
_evas_post_event_callback_call(Evas *eo_e, Evas_Public_Data *e)
{
Evas_Post_Callback *pc;
Eina_List *l, *l_next;
int skip = 0;
static int first_run = 1; // FIXME: This is a workaround to prevent this
// function from being called recursively.
@ -232,8 +233,9 @@ _evas_post_event_callback_call(Evas *eo_e, Evas_Public_Data *e)
if (e->delete_me || (!first_run)) return;
_evas_walk(e);
first_run = 0;
EINA_LIST_FREE(e->post_events, pc)
EINA_LIST_FOREACH_SAFE(e->post_events, l, l_next, pc)
{
e->post_events = eina_list_remove_list(e->post_events, l);
if ((!skip) && (!e->delete_me) && (!pc->delete_me))
{
if (!pc->func((void*)pc->data, eo_e)) skip = 1;
@ -577,12 +579,11 @@ evas_post_event_callback_push(Evas *eo_e, Evas_Object_Event_Post_Cb func, const
Evas_Public_Data *e = efl_data_scope_get(eo_e, EVAS_CANVAS_CLASS);
Evas_Post_Callback *pc;
if (!e) return;
if (!e || e->delete_me) return;
EVAS_MEMPOOL_INIT(_mp_pc, "evas_post_callback", Evas_Post_Callback, 64, );
pc = EVAS_MEMPOOL_ALLOC(_mp_pc, Evas_Post_Callback);
if (!pc) return;
EVAS_MEMPOOL_PREP(_mp_pc, pc, Evas_Post_Callback);
if (e->delete_me) return;
pc->func = func;
pc->data = data;

1
src/lib/evas/include/evas_private.h
View File

@ -785,7 +785,6 @@ struct _Evas_Lock
struct _Evas_Post_Callback
{
Evas_Object *obj;
Evas_Object_Event_Post_Cb func;
const void *data;
unsigned char delete_me : 1;