From 1c1a38ee147d461b7453ee5c0229543b529c94a2 Mon Sep 17 00:00:00 2001
From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Date: Sat, 13 May 2023 12:12:14 +0100
Subject: [PATCH] fix deletion order in QImageReader/Writer destructors

Origin: upstream, commits
 https://code.qt.io/cgit/qt/qtbase.git/commit/?id=f091026be1deb4b4
 https://code.qt.io/cgit/qt/qtbase.git/commit/?id=5633cb69f68ca3d3
Last-Update: 2023-02-26

The device would be deleted before the image format handler, and hence
be a dangling pointer that could easily cause a crash if the handler
or codec would access it on destruction, e.g. for cleanup.

Gbp-Pq: Name image_deletion_order.diff
---
 src/gui/image/qimagereader.cpp | 6 +++---
 src/gui/image/qimagewriter.cpp | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/gui/image/qimagereader.cpp b/src/gui/image/qimagereader.cpp
index 5cb7e1328..1274622d5 100644
--- a/src/gui/image/qimagereader.cpp
+++ b/src/gui/image/qimagereader.cpp
@@ -515,9 +515,9 @@ QImageReaderPrivate::QImageReaderPrivate(QImageReader *qq)
 */
 QImageReaderPrivate::~QImageReaderPrivate()
 {
+    delete handler;
     if (deleteDevice)
         delete device;
-    delete handler;
 }
 
 /*!
@@ -774,12 +774,12 @@ bool QImageReader::decideFormatFromContent() const
 */
 void QImageReader::setDevice(QIODevice *device)
 {
+    delete d->handler;
+    d->handler = nullptr;
     if (d->device && d->deleteDevice)
         delete d->device;
     d->device = device;
     d->deleteDevice = false;
-    delete d->handler;
-    d->handler = nullptr;
     d->text.clear();
 }
 
diff --git a/src/gui/image/qimagewriter.cpp b/src/gui/image/qimagewriter.cpp
index 33f5e491c..a679f2575 100644
--- a/src/gui/image/qimagewriter.cpp
+++ b/src/gui/image/qimagewriter.cpp
@@ -349,9 +349,9 @@ QImageWriter::QImageWriter(const QString &fileName, const QByteArray &format)
 */
 QImageWriter::~QImageWriter()
 {
+    delete d->handler;
     if (d->deleteDevice)
         delete d->device;
-    delete d->handler;
     delete d;
 }
 
@@ -396,13 +396,13 @@ QByteArray QImageWriter::format() const
 */
 void QImageWriter::setDevice(QIODevice *device)
 {
+    delete d->handler;
+    d->handler = nullptr;
     if (d->device && d->deleteDevice)
         delete d->device;
 
     d->device = device;
     d->deleteDevice = false;
-    delete d->handler;
-    d->handler = nullptr;
 }
 
 /*!
-- 
2.30.2