diff options
| author | Sami Shalayel <sami.shalayel@qt.io> | 2024-12-02 10:03:09 +0100 |
|---|---|---|
| committer | Sami Shalayel <sami.shalayel@qt.io> | 2024-12-03 09:55:46 +0100 |
| commit | 60cedb86cad9c3fc275e305e9615d67a2363d269 (patch) | |
| tree | 3ede806284515f8a256c4c41e71fb7faa24fed56 /src/qmlcompiler/qqmljsfunctioninitializer.cpp | |
| parent | 558e0f4240a6283ddb1c014eb57d2b7ac6c0101f (diff) | |
qmlls: fix crash in QLanguageServerPrivate destruction order
Fix crash where the shutdownResponse and protocol members of
QLanguageServerPrivate where destroyed in the wrong order by reordering
the members.
ShutdownResponse is initialized with a pointer to protocol, and uses
protocol in its destructor to send a message on destruction. During the
destruction of QLanguageServerPrivate, protocol gets destroyed before
shutdownResponse because of the member order in the
QLanguageServerPrivate class definition, leading to a
heap-use-after-free with the previous member order.
Responses are usually constructed after protocol, and have a pointer to
protocol to be able to send messages and errors. They have a short
lifetime, are constructed on the stack and used in handlers via
temporary refs (&&). They are supposed to be sent to the protocol
quickly after they were constructed, and then destroyed, so I think
responses should not take ownership of the protocol.
The current code assumes that the protocol is outliving all responses,
there is code in the response destructor to send an error if the
response was not used to send anything on the protocol, for example.
Therefore not sending a response because the protocol was already
destroyed does sound like an error or misuse of the response, and making
the response using a weak pointer just for this weird case does sound
unappropriate to me.
Add a comment stating that protocol has to be destroyed last.
Pick-to: 6.8
Task-number: QTBUG-131702
Change-Id: I329ecf4d9954e20e2868e21cc0663c19963f1643
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Diffstat (limited to 'src/qmlcompiler/qqmljsfunctioninitializer.cpp')
0 files changed, 0 insertions, 0 deletions
