timer23
/
efl
forked from enlightenment/efl
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

evas table - handle recursive access to cols/rows where child frees 

thsi fixes invalid memory access to already freed memory in a parent
call where a child freed it by reference counting the struct to
ensuire it stays alive in the parent func using it.

@fix
This commit is contained in:
Carsten Haitzler 2016-08-15 11:30:23 +09:00
parent 1d6a58cfc9
commit e7d56e9ece
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/lib/evas/canvas/evas_object_table.c
View File

@ -36,6 +36,7 @@ struct _Evas_Object_Table_Option
struct _Evas_Object_Table_Cache struct _Evas_Object_Table_Cache
{ {
int ref;
struct { struct {
struct { struct {
double h, v; double h, v;
@ -183,6 +184,7 @@ _evas_object_table_cache_alloc(int cols, int rows)
return NULL; return NULL;
} }
cache->ref = 1;
cache->weights.h = (double *)(cache + 1); cache->weights.h = (double *)(cache + 1);
cache->weights.v = (double *)(cache->weights.h + cols); cache->weights.v = (double *)(cache->weights.h + cols);
cache->sizes.h = (Evas_Coord *)(cache->weights.v + rows); cache->sizes.h = (Evas_Coord *)(cache->weights.v + rows);
@ -196,7 +198,8 @@ _evas_object_table_cache_alloc(int cols, int rows)
static void static void
_evas_object_table_cache_free(Evas_Object_Table_Cache *cache) _evas_object_table_cache_free(Evas_Object_Table_Cache *cache)
{ {
free(cache); cache->ref--;
if (cache->ref == 0) free(cache);
} }
static void static void
@ -643,6 +646,7 @@ _evas_object_table_calculate_hints_regular(Evas_Object *o, Evas_Table_Data *priv
return; return;
} }
c = priv->cache; c = priv->cache;
c->ref++;
_evas_object_table_cache_reset(priv); _evas_object_table_cache_reset(priv);
/* cache interesting data */ /* cache interesting data */
@ -767,7 +771,7 @@ _evas_object_table_calculate_hints_regular(Evas_Object *o, Evas_Table_Data *priv
if ((c->total.min.w > 0) || (c->total.min.h > 0)) if ((c->total.min.w > 0) || (c->total.min.h > 0))
evas_object_size_hint_min_set(o, c->total.min.w, c->total.min.h); evas_object_size_hint_min_set(o, c->total.min.w, c->total.min.h);
_evas_object_table_cache_free(c);
// XXX hint max? // XXX hint max?
} }
@ -783,6 +787,7 @@ _evas_object_table_calculate_layout_regular(Evas_Object *o, Evas_Table_Data *pri
c = priv->cache; c = priv->cache;
if (!c) return; if (!c) return;
c->ref++;
evas_object_geometry_get(o, &x, &y, &w, &h); evas_object_geometry_get(o, &x, &y, &w, &h);
/* handle horizontal */ /* handle horizontal */
@ -871,6 +876,7 @@ _evas_object_table_calculate_layout_regular(Evas_Object *o, Evas_Table_Data *pri
if (rows) free(rows); if (rows) free(rows);
} }
} }
_evas_object_table_cache_free(c);
} }
static void static void