kotschak/qelectrotech-source-mirror
0
0
Fork 0
mirror of https://github.com/qelectrotech/qelectrotech-source-mirror.git synced 2026-10-13 08:14:13 +02:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Fix the double free when a deleted cable is undone and edited again

Browse Source 
Deleting a cable and pressing Ctrl+Z twice leaves the cable out of the
project while AddCableCommand still stands and still thinks it has to
clean that cable up. The next edit of any kind makes the stack throw the
undone commands away: ~RemoveCableCommand frees the cable, and
~AddCableCommand frees the same memory again. A plain build hides it,
AddressSanitizer reports it as a heap-use-after-free in
addcablecommand.cpp (blocking review comment by ispyisail).

AddCableCommand now holds the cable as a QPointer, which is what
RemoveCableCommand already did: whoever of the two runs first frees it,
the other one sees a null pointer and has nothing left to do, in either
order of destruction. The destructor also stopped dereferencing
project() without checking it, which it did on that very line.

Covered by tst_cableundointegration, a probe linked against the
application's objects the way the other integration probes are. It draws
a cable, deletes it, undoes twice and pushes a further edit -- the
sequence which used to crash. Verified in both directions: with the raw
pointer the probe dies with SIGSEGV inside ~AddCableCommand called from
QUndoStack::push, with the QPointer it prints its PASS line.
This commit is contained in:
Kellermorph
2026-10-10 09:24:15 +02:00
parent 69eb071f45
commit a16964c055
5 changed files with 195 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sources/cable/addcablecommand.h
+11 -2
View File
@@ -55,8 +55,17 @@ class AddCableCommand : public QUndoCommand
QETProject *project() const;
private:
///The cable the line belongs to
Cable *m_cable = nullptr;
/**
The cable the line belongs to.
A pointer, not a raw one: RemoveCableCommand deletes the
cable when it goes, and both of them are torn down together
when the stack takes a new command. Whoever of the two runs
first frees the cable, so the other one must not follow it
into the freed memory -- QPointer goes null instead, and
this command then simply has nothing left to clean up.
*/
QPointer<Cable> m_cable;
///The line itself, owned by the folio once it is drawn
QPointer<CablePart> m_part;
QPointer<Diagram> m_diagram;