timer23
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Evas text: set NULL free'd pointers in evas_object_text_free() 

Summary:
_render_pre() function could be called for an object which is
going to be deleted. According to state changes of the object,
text could be recalculated with free'd pointers. It caused an
invalid read and crash.
@fix

Test Plan:
1. Apply D1747.
2. Run elementary_test.
3. Put any character in elm_entry and change paragraph direction.
4. Put any character again.
5. It can cause a crash which is caused by invalid read in Evas Text.

Reviewers: herdsman, woohyun, tasn, raster

Subscribers: cedric, jpeg

Differential Revision: https://phab.enlightenment.org/D3445
This commit is contained in:
Youngbok Shin 2016-02-15 10:41:37 +00:00 committed by Tom Hacohen
parent d79a1ade6c
commit b85ae77633
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/lib/evas/canvas/evas_object_text.c
View File

@ -1631,8 +1631,16 @@ evas_object_text_free(Evas_Object *eo_obj, Evas_Object_Protected_Data *obj)
if (o->font && obj->layer && obj->layer->evas)
evas_font_free(obj->layer->evas->evas, o->font);
o->font = NULL;
o->cur.utf8_text = NULL;
o->cur.font = NULL;
o->cur.fdesc = NULL;
o->cur.source = NULL;
o->bidi_delimiters = NULL;
o->cur.text = NULL;
o->prev = o->cur;
#ifdef BIDI_SUPPORT
evas_bidi_paragraph_props_unref(o->bidi_par_props);
o->bidi_par_props = NULL;
#endif
}