forked from bartvdbraak/blender
Fix for heap-use-after-free happening in GHOST_EventManager.
Issue was that dispatchEvent might call removeWindowEvents/ removeTypeEvents which will delete the event before we can do so. To address this, handled events are now put in a separate list. Reported by psy-fi and reviewed by brecht in IRC.
This commit is contained in:
parent
540ab7a55a
commit
7ef10decdb
@ -106,11 +106,10 @@ void GHOST_EventManager::dispatchEvent(GHOST_IEvent *event)
|
|||||||
void GHOST_EventManager::dispatchEvent()
|
void GHOST_EventManager::dispatchEvent()
|
||||||
{
|
{
|
||||||
GHOST_IEvent *event = m_events.back();
|
GHOST_IEvent *event = m_events.back();
|
||||||
|
m_events.pop_back();
|
||||||
|
m_handled_events.push_back(event);
|
||||||
|
|
||||||
dispatchEvent(event);
|
dispatchEvent(event);
|
||||||
|
|
||||||
m_events.pop_back();
|
|
||||||
delete event;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -119,6 +118,8 @@ void GHOST_EventManager::dispatchEvents()
|
|||||||
while (!m_events.empty()) {
|
while (!m_events.empty()) {
|
||||||
dispatchEvent();
|
dispatchEvent();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
disposeEvents();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
@ -213,6 +214,12 @@ void GHOST_EventManager::removeTypeEvents(GHOST_TEventType type, GHOST_IWindow *
|
|||||||
|
|
||||||
void GHOST_EventManager::disposeEvents()
|
void GHOST_EventManager::disposeEvents()
|
||||||
{
|
{
|
||||||
|
while (m_handled_events.empty() == false) {
|
||||||
|
GHOST_ASSERT(m_handled_events[0], "invalid event");
|
||||||
|
delete m_handled_events[0];
|
||||||
|
m_handled_events.pop_front();
|
||||||
|
}
|
||||||
|
|
||||||
while (m_events.empty() == false) {
|
while (m_events.empty() == false) {
|
||||||
GHOST_ASSERT(m_events[0], "invalid event");
|
GHOST_ASSERT(m_events[0], "invalid event");
|
||||||
delete m_events[0];
|
delete m_events[0];
|
||||||
|
@ -146,6 +146,7 @@ protected:
|
|||||||
|
|
||||||
/** The event stack. */
|
/** The event stack. */
|
||||||
std::deque<GHOST_IEvent *> m_events;
|
std::deque<GHOST_IEvent *> m_events;
|
||||||
|
std::deque<GHOST_IEvent *> m_handled_events;
|
||||||
|
|
||||||
/** A vector with event consumers. */
|
/** A vector with event consumers. */
|
||||||
typedef std::vector<GHOST_IEventConsumer *> TConsumerVector;
|
typedef std::vector<GHOST_IEventConsumer *> TConsumerVector;
|
||||||
|
Loading…
Reference in New Issue
Block a user