fix deletion order in QImageReader/Writer destructors

Origin: upstream, commits
 https://code.qt.io/cgit/qt/qtbase.git/commit/?id=f091026be1deb4b4
 https://code.qt.io/cgit/qt/qtbase.git/commit/?id=5633cb69f68ca3d3
Last-Update: 2023-02-26

The device would be deleted before the image format handler, and hence
be a dangling pointer that could easily cause a crash if the handler
or codec would access it on destruction, e.g. for cleanup.

Gbp-Pq: Name image_deletion_order.diff

diff --git a/src/gui/image/qimagereader.cpp b/src/gui/image/qimagereader.cpp
index 5cb7e1328e83418d0197735a39ad0632974d6ed1..1274622d5326b215bd5fa41a41007cb3812ed016 100644 (file)
--- a/src/gui/image/qimagereader.cpp
+++ b/src/gui/image/qimagereader.cpp
@@ -515,9 +515,9 @@ QImageReaderPrivate::QImageReaderPrivate(QImageReader *qq)
 */
 QImageReaderPrivate::~QImageReaderPrivate()
 {
+    delete handler;
     if (deleteDevice)
         delete device;
-    delete handler;
 }
 
 /*!
@@ -774,12 +774,12 @@ bool QImageReader::decideFormatFromContent() const
 */
 void QImageReader::setDevice(QIODevice *device)
 {
+    delete d->handler;
+    d->handler = nullptr;
     if (d->device && d->deleteDevice)
         delete d->device;
     d->device = device;
     d->deleteDevice = false;
-    delete d->handler;
-    d->handler = nullptr;
     d->text.clear();
 }
 

diff --git a/src/gui/image/qimagewriter.cpp b/src/gui/image/qimagewriter.cpp
index 33f5e491c7ea0d1ef9f25388b7329297761cfd5a..a679f25757d1a002246f939790c0b933f86e0626 100644 (file)
--- a/src/gui/image/qimagewriter.cpp
+++ b/src/gui/image/qimagewriter.cpp
@@ -349,9 +349,9 @@ QImageWriter::QImageWriter(const QString &fileName, const QByteArray &format)
 */
 QImageWriter::~QImageWriter()
 {
+    delete d->handler;
     if (d->deleteDevice)
         delete d->device;
-    delete d->handler;
     delete d;
 }
 
@@ -396,13 +396,13 @@ QByteArray QImageWriter::format() const
 */
 void QImageWriter::setDevice(QIODevice *device)
 {
+    delete d->handler;
+    d->handler = nullptr;
     if (d->device && d->deleteDevice)
         delete d->device;
 
     d->device = device;
     d->deleteDevice = false;
-    delete d->handler;
-    d->handler = nullptr;
 }
 
 /*!