Skip to content

Commit

Permalink
Fix invalid read in RemotePlugin::RemotePlugin() on opening the ZynAd…
Browse files Browse the repository at this point in the history 
…dSubFx GUI.

Calling .toUtf8().constData() returns a pointer which is deleted at the end of the statement.

Invalid read of size 1
   at 0x4839A42: __strlen_sse2 (vg_replace_strmem.c:461)
   by 0x2884E7: RemotePlugin::RemotePlugin() (in /lmms/build/lmms)
   by 0x281DD3C1: ZynAddSubFxRemotePlugin::ZynAddSubFxRemotePlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281DEC50: ZynAddSubFxInstrument::initPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2DC9: ZynAddSubFxInstrument::reloadPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2EA3: ZynAddSubFxView::toggleUI() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x699E59D: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3803)
   by 0x4B2B5E1: QAbstractButton::toggled(bool) (moc_qabstractbutton.cpp:319)
   by 0x4B2B9F0: QAbstractButtonPrivate::emitToggled(bool) (qabstractbutton.cpp:456)
   by 0x4B2CFB8: QAbstractButton::setChecked(bool) (qabstractbutton.cpp:649)
   by 0x4B2CADC: QAbstractButtonPrivate::click() (qabstractbutton.cpp:397)
   by 0x4B2CD14: QAbstractButton::mouseReleaseEvent(QMouseEvent*) (qabstractbutton.cpp:1011)
 Address 0x22833e58 is 24 bytes inside a block of size 128 free'd
   at 0x4837900: free (vg_replace_malloc.c:538)
   by 0x2886F3: RemotePlugin::RemotePlugin() (in /lmms/build/lmms)
   by 0x281DD3C1: ZynAddSubFxRemotePlugin::ZynAddSubFxRemotePlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281DEC50: ZynAddSubFxInstrument::initPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2DC9: ZynAddSubFxInstrument::reloadPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2EA3: ZynAddSubFxView::toggleUI() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x699E59D: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3803)
   by 0x4B2B5E1: QAbstractButton::toggled(bool) (moc_qabstractbutton.cpp:319)
   by 0x4B2B9F0: QAbstractButtonPrivate::emitToggled(bool) (qabstractbutton.cpp:456)
   by 0x4B2CFB8: QAbstractButton::setChecked(bool) (qabstractbutton.cpp:649)
   by 0x4B2CADC: QAbstractButtonPrivate::click() (qabstractbutton.cpp:397)
   by 0x4B2CD14: QAbstractButton::mouseReleaseEvent(QMouseEvent*) (qabstractbutton.cpp:1011)
 Block was alloc'd at
   at 0x4838B99: realloc (vg_replace_malloc.c:834)
   by 0x67F2D0B: reallocateData (qarraydata.cpp:83)
   by 0x67F2D0B: QArrayData::reallocateUnaligned(QArrayData*, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) (qarraydata.cpp:146)
   by 0x67F48B1: reallocateUnaligned (qarraydata.h:232)
   by 0x67F48B1: QByteArray::reallocData(unsigned int, QFlags<QArrayData::AllocationOption>) (qbytearray.cpp:1914)
   by 0x67F4A6F: QByteArray::resize(int) (qbytearray.cpp:1875)
   by 0x69CA143: QUtf8::convertFromUnicode(QChar const*, int) (qutfcodec.cpp:396)
   by 0x6861C27: qt_convert_to_utf8 (qstring.cpp:5423)
   by 0x6861C27: QString::toUtf8_helper(QString const&) (qstring.cpp:5415)
   by 0x2884A9: RemotePlugin::RemotePlugin() (in /lmms/build/lmms)
   by 0x281DD3C1: ZynAddSubFxRemotePlugin::ZynAddSubFxRemotePlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281DEC50: ZynAddSubFxInstrument::initPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2DC9: ZynAddSubFxInstrument::reloadPlugin() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x281E2EA3: ZynAddSubFxView::toggleUI() (in /lmms/build/plugins/libzynaddsubfx.so)
   by 0x699E59D: QMetaObject::activate(QObject*, int, int, void**) (qobject.cpp:3803)
  • Loading branch information
@Cyp
Cyp committed Nov 1, 2019
1 parent a8d91b1 commit 62592f2
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/core/RemotePlugin.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ RemotePlugin::RemotePlugin() :

m_socketFile = QDir::tempPath() + QDir::separator() +
QUuid::createUuid().toString();
const char * path = m_socketFile.toUtf8().constData();
char const *path = qstrdup(m_socketFile.toUtf8().constData());
size_t length = strlen( path );
if ( length >= sizeof sa.sun_path )
{
Expand All @@ -122,6 +122,7 @@ RemotePlugin::RemotePlugin() :
{
qWarning( "Unable to start the server." );
}
delete[] path;
#endif
connect( &m_process, SIGNAL( finished( int, QProcess::ExitStatus ) ),
this, SLOT( processFinished( int, QProcess::ExitStatus ) ),
Expand Down

0 comments on commit 62592f2

Please sign in to comment.