Review Request 126411: KF5::Plasma: Fix potential use-after-free in FrameSVG

[Michael Pyne]

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://git.reviewboard.kde.org/r/126411/
-----------------------------------------------------------

(Updated Dec. 18, 2015, 2:36 a.m.)


Status
------

This change has been marked as submitted.


Review request for Plasma.


Changes
-------

Submitted with commit 600bdda04508fab512ed97c9874353378c7cb3fa by Michael Pyne to branch master.


Repository: plasma-framework


Description
-------

Plasma framework's FrameSVG class uses cached regions for efficiency. However Coverity caught a mis-use of QCache in FrameSvg::mask(), which could lead to a use-after-free situation. (CID 1291560)

Basically, any pointer passed into QCache::insert must be assumed to be deleted after insert() has been called -- we can't then return that pointer to the caller.

Moreover we were simply returning a pointer to calling code that had been (and still would be) owned by QCache, which is unsafe as it can be deleted at any time. The fix in both cases is to make a local copy of the QRegion from out of the cache and return that.

I didn't thoroughly look for other cases where we return cached pointers, or evaluate whether the performance impact from making local copies makes the cache less useful, this patch just fixes the immediate bug.


Diffs
-----

  src/plasma/framesvg.cpp 107e0e6 

Diff: https://git.reviewboard.kde.org/r/126411/diff/


Testing
-------

Everything compiles, Plasma shell boots up with the new code without issue, switching Plasma themes works fine.

I checked for open bugs but didn't see anything obvious (that wasn't already closed years ago, at least).


Thanks,

Michael Pyne

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/plasma-devel/attachments/20151218/d3a145ce/attachment.html>