Skip to content

Commit

Permalink
Fix possible use-after-free in VerticalLayout.
Browse files Browse the repository at this point in the history
If some row widgets of VerticalLayout are living
in its own lifetime() we have a use-after-free.

Because this lifetime() destroys this child row
already after ~VerticalLayout which can call back
into VerticalLayout::childHeightUpdated (the subscription
lives inside the same lifetime() as well) which
will access _rows member that was already destroyed.

Now all subscriptions die before _rows are destroyed.
  • Loading branch information
john-preston committed Apr 14, 2022
1 parent 258cacf commit aa155db
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
2 changes: 1 addition & 1 deletion ui/wrap/vertical_layout.cpp
Expand Up @@ -133,7 +133,7 @@ RpWidget *VerticalLayout::insertChild(
}
}, [=] {
removeChild(weak);
}, lifetime());
}, _rowsLifetime);
return weak;
}
return nullptr;
Expand Down
2 changes: 2 additions & 0 deletions ui/wrap/vertical_layout.h
Expand Up @@ -82,6 +82,8 @@ class VerticalLayout : public RpWidget {
std::vector<Row> _rows;
bool _inResize = false;

rpl::lifetime _rowsLifetime;

};

} // namespace Ui

0 comments on commit aa155db

Please sign in to comment.