mifr/subsurface
1
0
Fork 0
mirror of https://github.com/subsurface/subsurface.git synced 2025-02-19 22:16:15 +00:00
Code Issues Projects Releases Packages Wiki Activity

Cleanup: return copied string from hashstring()

Browse source 
The following statement in the hashstring() function:
  return hashOf[QString(filename)].toHex().data();
returns data of the temporary QByteArray generated by toHex().
Thus, the caller will access released memory, which could lead to
data corruption.

Signed-off-by: Berthold Stoeger <bstoeger@mail.tuwien.ac.at>
This commit is contained in:
Berthold Stoeger 2018-02-17 12:33:40 +01:00 • committed by Dirk Hohndel
parent 88d0ce499d
commit e880948d73
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/qthelper.cpp
View file

@ -1071,7 +1071,7 @@ QHash <QString, QImage > thumbnailCache;
extern "C" char * hashstring(const char *filename)
{
QMutexLocker locker(&hashOfMutex);
return hashOf[QString(filename)].toHex().data();
return strdup(hashOf[QString(filename)].toHex().data());
}
const QString hashfile_name()

6
core/save-xml.c
View file

@ -435,8 +435,10 @@ static void save_picture(struct membuffer *b, struct picture *pic)
put_degrees(b, pic->latitude, " gps='", " ");
put_degrees(b, pic->longitude, "", "'");
}
if (hashstring(pic->filename))
put_format(b, " hash='%s'", hashstring(pic->filename));
char *hash = hashstring(pic->filename);
if (!empty_string(hash))
put_format(b, " hash='%s'", hash);
free(hash);
put_string(b, "/>\n");
}