From 855ce94a327bed9caa05036ed4dc470c8d2448f0 Mon Sep 17 00:00:00 2001 From: Debian Qt/KDE Maintainers Date: Thu, 16 Apr 2020 18:05:12 +0100 Subject: [PATCH] fix iteration in source check in error case Origin: upstream, https://code.qt.io/cgit/qt/qtbase.git/commit/?id=37df81b788ebe700 Last-Update: 2020-04-16 It was accessing the deleted current element in a potentially reallocated container. Gbp-Pq: Name qeventdispatcher_glib_use_after_free.diff --- src/corelib/kernel/qeventdispatcher_glib.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/corelib/kernel/qeventdispatcher_glib.cpp b/src/corelib/kernel/qeventdispatcher_glib.cpp index 45c6e29e4..34c2dde6a 100644 --- a/src/corelib/kernel/qeventdispatcher_glib.cpp +++ b/src/corelib/kernel/qeventdispatcher_glib.cpp @@ -86,9 +86,10 @@ static gboolean socketNotifierSourceCheck(GSource *source) p->pollfd.fd, t[int(p->socketNotifier->type())]); // ### note, modifies src->pollfds! p->socketNotifier->setEnabled(false); + i--; + } else { + pending = pending || ((p->pollfd.revents & p->pollfd.events) != 0); } - - pending = ((p->pollfd.revents & p->pollfd.events) != 0); } return pending; -- 2.30.2