Fix Coverity use-after-free (and possible leak)

qgis · Aug 28, 2015 · dec4f5c · dec4f5c
1 parent c24192b
commit dec4f5c
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 2 deletions.
diff --git a/src/core/geometry/qgsgeometry.cpp b/src/core/geometry/qgsgeometry.cpp
@@ -550,6 +550,7 @@ int QgsGeometry::addRing( QgsCurveV2* ring )
 {
   if ( !d || !d->geometry )
   {
+    delete ring;
     return 1;
   }
 

diff --git a/src/core/qgsvectorlayer.cpp b/src/core/qgsvectorlayer.cpp
@@ -1056,6 +1056,7 @@ int QgsVectorLayer::addRing( QgsCurveV2* ring )
 {
   if ( !mEditBuffer || !mDataProvider )
   {
+    delete ring;
     return 6;
   }
 
@@ -1066,7 +1067,8 @@ int QgsVectorLayer::addRing( QgsCurveV2* ring )
 
   if ( !ring->isClosed() )
   {
-    delete ring; return 2;
+    delete ring;
+    return 2;
   }
 
   QgsVectorLayerEditUtils utils( this );

diff --git a/src/core/qgsvectorlayereditutils.cpp b/src/core/qgsvectorlayereditutils.cpp
@@ -120,7 +120,10 @@ int QgsVectorLayerEditUtils::addRing( const QList<QgsPoint>& ring )
 int QgsVectorLayerEditUtils::addRing( QgsCurveV2* ring )
 {
   if ( !L->hasGeometryType() )
+  {
+    delete ring;
     return 5;
+  }
 
   int addRingReturnCode = 5; //default: return code for 'ring not inserted'
   QgsRectangle bBox = ring->boundingBox();
@@ -129,7 +132,8 @@ int QgsVectorLayerEditUtils::addRing( QgsCurveV2* ring )
   QgsFeature f;
   while ( fit.nextFeature( f ) )
   {
-    addRingReturnCode = f.geometry()->addRing( ring );
+    //add ring takes ownership of ring, and deletes it if there's an error
+    addRingReturnCode = f.geometry()->addRing( static_cast< QgsCurveV2* >( ring->clone() ) );
     if ( addRingReturnCode == 0 )
     {
       L->editBuffer()->changeGeometry( f.id(), f.geometry() );
@@ -139,6 +143,7 @@ int QgsVectorLayerEditUtils::addRing( QgsCurveV2* ring )
     }
   }
 
+  delete ring;
   return addRingReturnCode;
 }