fix iteration in source check in error case

Origin: upstream, https://code.qt.io/cgit/qt/qtbase.git/commit/?id=37df81b788ebe700
Last-Update: 2020-04-16

It was accessing the deleted current element in a potentially
reallocated container.

Gbp-Pq: Name qeventdispatcher_glib_use_after_free.diff

diff --git a/src/corelib/kernel/qeventdispatcher_glib.cpp b/src/corelib/kernel/qeventdispatcher_glib.cpp
index 45c6e29e4bebee8fa114633f14644653b9d3eb73..34c2dde6a8f4e9c9974d6a5de663dab06bc93f2b 100644 (file)
--- a/src/corelib/kernel/qeventdispatcher_glib.cpp
+++ b/src/corelib/kernel/qeventdispatcher_glib.cpp
@@ -86,9 +86,10 @@ static gboolean socketNotifierSourceCheck(GSource *source)
                      p->pollfd.fd, t[int(p->socketNotifier->type())]);
             // ### note, modifies src->pollfds!
             p->socketNotifier->setEnabled(false);
+            i--;
+        } else {
+            pending = pending || ((p->pollfd.revents & p->pollfd.events) != 0);
         }
-
-        pending = ((p->pollfd.revents & p->pollfd.events) != 0);
     }
 
     return pending;