Skip to content

Commit ca8712b

Browse files
committed
Fix: Prevent heap-use-after-free crash when importing XML via Script Editor (#8470)
This fixes a regression where importing an XML file via the Import button in the Script Editor caused a heap-use-after-free crash, while drag-and-drop of the same file worked fine. Root cause: In slot_import(), after clearing all tree widgets, the current item pointers (mpCurrentTriggerItem, mpCurrentTimerItem, etc.) were left pointing to freed memory. When slot_profileSaveAction() was subsequently called, it invoked slot_saveEdits(), which attempted to save using these dangling pointers, resulting in a crash when accessing freed QTreeWidgetItem objects. Solution: Clear all current item pointers immediately after clearing tree widgets and BEFORE calling slot_profileSaveAction(). This ensures that the save operations in slot_saveEdits() will safely early-return due to nullptr checks at the beginning of each save function (saveTrigger(), saveTimer(), etc.). This follows the same pattern used in runScheduledCleanReset() which has a similar comment explaining the same safety measure. The import still succeeds (the script is imported), but now without crashing.
1 parent 034612d commit ca8712b

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

src/dlgTriggerEditor.cpp

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11500,17 +11500,18 @@ void dlgTriggerEditor::slot_import()
1150011500
treeWidget_keys->clear();
1150111501
treeWidget_scripts->clear();
1150211502

11503-
slot_profileSaveAction();
11504-
11505-
fillout_form();
11506-
11503+
// Nullify current item pointers before saving to prevent use-after-free
1150711504
mpCurrentTriggerItem = nullptr;
1150811505
mpCurrentTimerItem = nullptr;
1150911506
mpCurrentAliasItem = nullptr;
1151011507
mpCurrentScriptItem = nullptr;
1151111508
mpCurrentActionItem = nullptr;
1151211509
mpCurrentKeyItem = nullptr;
1151311510

11511+
slot_profileSaveAction();
11512+
11513+
fillout_form();
11514+
1151411515
slot_showTriggers();
1151511516
}
1151611517

0 commit comments

Comments
 (0)