https://bugs.kde.org/show_bug.cgi?id=524620
Bug ID: 524620
Summary: KDEPlatformMessageDialogHelper keeps a raw pointer to
a WA_DeleteOnClose message box
Classification: Plasma
Product: plasma-integration
Version First 6.7.4
Reported In:
Platform: Other
OS: Linux
Status: REPORTED
Severity: crash
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Plasma 6, plasma-integration 6.7.4, Qt 6.11.2, Wayland session.
KDEPlatformMessageDialogHelper::show() creates its box with
"m_box = new QMessageBox()" and then setAttribute(Qt::WA_DeleteOnClose).
QDialog::exec() honours that attribute and deletes the box when it returns,
so m_box is left dangling.
Three places dereference it afterwards without a check: hide(), exec() and
the queued lambda that calls open(). hide() is the one that bites: Qt calls
QDialogPrivate::setNativeDialogVisible(false) from ~QMessageBox, so an
application whose own message box is destroyed without having been hidden
first reads the freed helper dialog.
Caught on a plain Qt Widgets application, core dump kept. Key frames:
#0 0x0000000000000071 <- jump through a recycled vtable slot
#1 QDialogPrivate::setNativeDialogVisible(bool)
#2 QMessageBoxPrivate::setVisible(bool)
#3 QMessageBox::~QMessageBox()
In the core: nativeDialogInUse = 1, m_platformHelper is a
KDEPlatformMessageDialogHelper (vtable in KDEPlasmaPlatformTheme6.so), and
its box member points into a freed 40-byte block. hide() is literally
"mov 0x20(%rdi),%rdi; jmp QWidget::hide" - no null check, no QPointer.
I could not reproduce the recorded state on demand - about twenty click
flows were tried and none left the box unhidden at destruction time - so
the report rests on the core dump plus the code path, not on a repeatable
recipe.
The same code is in 6.7.4 and in master. Fix proposed as a merge request:
https://invent.kde.org/plasma/plasma-integration/-/merge_requests/242
--
You are receiving this mail because:
You are watching all bug changes.
