Commit a4a57b9
committed
Fix out-of-bounds write in TextPagerEdit
TextEditPrivate::actions was sized with the enumerator value
SelectAllAction (i.e. 1) rather than an element count, leaving room for
a single QAction while the constructor initialises two. The write to
actions[1] hit the adjacent sectionPressed member; being undefined
behaviour, at -O0 it merely corrupted that member, while at -O2 GCC 14
used the single-element bound to constrain the loop index and broke the
loop exit condition, making ecFlowUI segfault whenever a TextPagerEdit
was constructed, as is the case with Panels > Add info panel.
Introduce ActionCount and size the array with it, replace the
null-sentinel loop with a bounded loop, and tie the shortcut table to
ActionType with a static_assert.1 parent 790d164 commit a4a57b9
3 files changed
Lines changed: 9 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
15 | 15 | | |
16 | 16 | | |
17 | 17 | | |
| 18 | + | |
18 | 19 | | |
19 | 20 | | |
20 | 21 | | |
| |||
72 | 73 | | |
73 | 74 | | |
74 | 75 | | |
75 | | - | |
76 | | - | |
77 | | - | |
| 76 | + | |
| 77 | + | |
| 78 | + | |
| 79 | + | |
| 80 | + | |
78 | 81 | | |
79 | 82 | | |
80 | 83 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
153 | 153 | | |
154 | 154 | | |
155 | 155 | | |
156 | | - | |
| 156 | + | |
| 157 | + | |
157 | 158 | | |
158 | 159 | | |
159 | 160 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
95 | 95 | | |
96 | 96 | | |
97 | 97 | | |
98 | | - | |
| 98 | + | |
99 | 99 | | |
100 | 100 | | |
101 | 101 | | |
| |||
0 commit comments