diff options
| author | David Faure <[email protected]> | 2025-03-17 23:55:19 +0100 |
|---|---|---|
| committer | David Faure <[email protected]> | 2025-03-18 17:32:04 +0100 |
| commit | 215619d71b69be02348e12dc2dfea087c3ec2abb (patch) | |
| tree | 77f376563600170d892127758667e3c6535cfdaf | |
| parent | 9a8b7ce2b707d264ea18e019757695130e7a76f8 (diff) | |
QV4::ForInIteratorObject::nextProperty: fix null pointer dereference
UBSAN says
/opt/workspace/qtsrc/qtdeclarative/src/qml/jsruntime/qv4object_p.h:105:5: runtime error: member access within null pointer of type 'struct Object'
#0 0x7fdead25f886 in QV4::Object::d() const /opt/workspace/qtsrc/qtdeclarative/src/qml/jsruntime/qv4object_p.h:105
#1 0x7fdead6c2ba5 in QV4::ForInIteratorObject::nextProperty() const /opt/workspace/qtsrc/qtdeclarative/src/qml/jsruntime/qv4objectiterator.cpp:162
and indeed the if (!c) just after this line indicates that c can be
null.
Pick-to: 6.9 6.8 6.5
Change-Id: I3124ccf7aeebf4594d316b1d81c001638c290e24
Reviewed-by: Olivier De Cannière <[email protected]>
Reviewed-by: Fabian Kosmale <[email protected]>
Reviewed-by: Ulf Hermann <[email protected]>
| -rw-r--r-- | src/qml/jsruntime/qv4objectiterator.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/qml/jsruntime/qv4objectiterator.cpp b/src/qml/jsruntime/qv4objectiterator.cpp index eac2aca059..573f42956d 100644 --- a/src/qml/jsruntime/qv4objectiterator.cpp +++ b/src/qml/jsruntime/qv4objectiterator.cpp @@ -159,7 +159,7 @@ PropertyKey ForInIteratorObject::nextProperty() const } c = c->getPrototypeOf(); - d()->current.set(scope.engine, c->d()); + d()->current.set(scope.engine, c ? c->d() : nullptr); if (!c) break; delete d()->iterator; |