From c8c2aaafdf6180c271cf54576e5c2d5e25281947 Mon Sep 17 00:00:00 2001 From: Erik Verbruggen Date: Wed, 27 Aug 2014 13:41:25 +0200 Subject: C++: Fix possible use-after-free of AST. The CppRefactoringChanges::fileNoEditor takes a Document from the snapshot it has. Although this snapshot is a safe copy, it might have been gotten right after it was updated by indexing. Such a document will still have its AST. If this AST is used by any refactoring action without retaining it, the pointers will be dangling after a short while (specifically: after the locator has extracted all the information). The fileNoEditor method is called by the declDefLinkFinder to search the target document. The snapshot is obtained before, and contains the document for the semantic info. However, the target document will not come from the semantic info, but from the indexer. Change-Id: I212ff41dde6910e94e80552b2c3e5911fe9496ae Task-number: QTCREATORBUG-11262 Reviewed-by: Nikolai Kosjar --- src/plugins/cpptools/cpprefactoringchanges.cpp | 4 ---- 1 file changed, 4 deletions(-) (limited to 'src/plugins/cpptools/cpprefactoringchanges.cpp') diff --git a/src/plugins/cpptools/cpprefactoringchanges.cpp b/src/plugins/cpptools/cpprefactoringchanges.cpp index a07d7a404c..045633077b 100644 --- a/src/plugins/cpptools/cpprefactoringchanges.cpp +++ b/src/plugins/cpptools/cpprefactoringchanges.cpp @@ -112,10 +112,6 @@ CppRefactoringFileConstPtr CppRefactoringChanges::fileNoEditor(const QString &fi CppRefactoringFilePtr result(new CppRefactoringFile(document, fileName)); result->m_data = m_data; - Document::Ptr cppDocument = data()->m_snapshot.document(fileName); - if (cppDocument) - result->setCppDocument(cppDocument); - return result; } -- cgit v1.2.1