Skip to content
Permalink
Browse files

QgsXmlUtils::readFlagAttribute(): fix use-after-free

Found with Valgrind

```const char* c_str = qstr.toUtf8().data()``` is invalid
since the QByteArray returned by toUtf8() is destroyed at the
end of the expression, letting c_str point to freed memory

On the contrary ```foo(qstr.toUtf8().data())``` is valid since
the temporary object is destroyed only after foo invokation.
  • Loading branch information
rouault committed Oct 6, 2018
1 parent 81db005 commit f5d2d858606699e430cb8678d26b1fbf836d8190
Showing with 1 addition and 2 deletions.
  1. +1 −2 src/core/qgsxmlutils.h
@@ -97,8 +97,7 @@ class CORE_EXPORT QgsXmlUtils
if ( metaEnum.isValid() )
{
bool ok = false;
const char *vs = sourceCategoriesStr.toUtf8().data();
int newValue = metaEnum.keysToValue( vs, &ok );
int newValue = metaEnum.keysToValue( sourceCategoriesStr.toUtf8().data(), &ok );
if ( ok )
value = static_cast<T>( newValue );
}

0 comments on commit f5d2d85

Please sign in to comment.
You can’t perform that action at this time.