[Pkg-owncloud-commits] [owncloud-client] 16/159: Fix a crash when accessing a dangling UploadDevice pointer #2984

[Sandro Knauß]

This is an automated email from the git hooks/post-receive script.

hefee-guest pushed a commit to branch master
in repository owncloud-client.

commit 3c9acdf724e3bc01be2da1ea0d6467a8f42c6ae6
Author: Jocelyn Turcotte <jocelyn.turcotte at digia.com>
Date:   Mon Mar 23 16:13:52 2015 +0100

    Fix a crash when accessing a dangling UploadDevice pointer #2984
    
    This is largely a guess, but this is the only place where we use
    a QIODevice to push data through QNAM and that the QIODevice isn't
    a direct child of the QNetworkReply.
    
    Fix the issue by making sure that we don't go back to the event loop
    and possibly handle network events between the destruction of the
    upload QIODevice and the QNetworkReply, which might lead to QNAM
    dereferencing a dangling QIODevice pointer.
---
 src/libsync/networkjobs.cpp     | 13 ++++++-------
 src/libsync/propagateupload.cpp |  6 ++++++
 src/libsync/propagateupload.h   |  1 +
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/libsync/networkjobs.cpp b/src/libsync/networkjobs.cpp
index 8afb284..d74c6cf 100644
--- a/src/libsync/networkjobs.cpp
+++ b/src/libsync/networkjobs.cpp
@@ -68,11 +68,12 @@ AbstractNetworkJob::AbstractNetworkJob(AccountPtr account, const QString &path,
 
 void AbstractNetworkJob::setReply(QNetworkReply *reply)
 {
-    if (_reply) {
-        _reply->deleteLater();
-    }
-    reply->setProperty("doNotHandleAuth", true);
+    if (reply)
+        reply->setProperty("doNotHandleAuth", true);
+
+    QNetworkReply *old = _reply;
     _reply = reply;
+    delete old;
 }
 
 void AbstractNetworkJob::setTimeout(qint64 msec)
@@ -213,9 +214,7 @@ QByteArray AbstractNetworkJob::responseTimestamp()
 
 AbstractNetworkJob::~AbstractNetworkJob()
 {
-    if (_reply) {
-        _reply->deleteLater();
-    }
+    setReply(0);
 }
 
 void AbstractNetworkJob::start()
diff --git a/src/libsync/propagateupload.cpp b/src/libsync/propagateupload.cpp
index 9ca097f..4bcbe79 100644
--- a/src/libsync/propagateupload.cpp
+++ b/src/libsync/propagateupload.cpp
@@ -64,6 +64,12 @@ static qint64 chunkSize() {
     return chunkSize;
 }
 
+PUTFileJob::~PUTFileJob()
+{
+    // Make sure that we destroy the QNetworkReply before our _device of which it keeps an internal pointer.
+    setReply(0);
+}
+
 void PUTFileJob::start() {
     QNetworkRequest req;
     for(QMap<QByteArray, QByteArray>::const_iterator it = _headers.begin(); it != _headers.end(); ++it) {
diff --git a/src/libsync/propagateupload.h b/src/libsync/propagateupload.h
index a68d034..3e345fa 100644
--- a/src/libsync/propagateupload.h
+++ b/src/libsync/propagateupload.h
@@ -74,6 +74,7 @@ public:
     explicit PUTFileJob(AccountPtr account, const QString& path, QIODevice *device,
                         const QMap<QByteArray, QByteArray> &headers, int chunk, QObject* parent = 0)
         : AbstractNetworkJob(account, path, parent), _device(device), _headers(headers), _chunk(chunk) {}
+    ~PUTFileJob();
 
     int _chunk;
 

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud-client.git