Review Request 126409: Fix use-after-free in .desktop file parser

[Michael Pyne]

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/126409/
-----------------------------------------------------------

(Updated Dec. 18, 2015, 3:44 a.m.)


Review request for KDE Frameworks and Alex Richardson.


Changes
-------

Reorder if/else, remove temporary var.


Repository: kcoreaddons


Description
-------

Patch to fix a use-after-free issue in kcoreaddons/src/lib/plugin/desktopfileparser.cpp, noted by Coverity (CID 1336157)

The issue is that if `defs << *def` happens after the call to s_serviceTypes->insert(), the `*def` might already have been deleted by QCache. Attached patch fixes by making the copy before the call to insert().

Really, it's probably better to not use QCache here if we can avoid it, but I'm not sure enough of the code to go that route. But if this is something that's only run once or twice anyways then there's no real need to use QCache instead of QMap, I would think.


Diffs (updated)
-----

  src/lib/plugin/desktopfileparser.cpp 06a4a1d 

Diff: https://git.reviewboard.kde.org/r/126409/diff/


Testing
-------

desktoptojsontest still passes, code compiles.


Thanks,

Michael Pyne

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/kde-frameworks-devel/attachments/20151218/46c90413/attachment.html>