mirror/tesseract
1
0
Fork 0
mirror of https://github.com/tesseract-ocr/tesseract.git synced 2024-11-24 02:59:07 +08:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

viewer: Fix double free caused by ScrollView::MessageReceiver

Browse Source 
waiting_for_events takes ownership of the passed event which is later
deleted. Since we use unique_ptr::get() to acquire the pointer, we cause
double free: one free happens in the code path where the event from
waiting_for_events goes and the other free happens in unique_ptr
destructor.

The fix is to move ownership out of unique_ptr by unique_ptr::release().

Fixes: https://github.com/tesseract-ocr/tesseract/issues/3869
Fixes: 37b33749da
This commit is contained in:
Povilas Kanapickas 2022-07-18 18:04:29 +03:00
parent 87dd04fe26
commit 4f831ff489
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/viewer/scrollview.cpp
View File

@ -158,13 +158,13 @@ void ScrollView::MessageReceiver() {
SVET_ANY);
waiting_for_events_mu->lock();
if (waiting_for_events.count(awaiting_list) > 0) {
waiting_for_events[awaiting_list].second = cur.get();
waiting_for_events[awaiting_list].second = cur.release();
waiting_for_events[awaiting_list].first->Signal();
} else if (waiting_for_events.count(awaiting_list_any) > 0) {
waiting_for_events[awaiting_list_any].second = cur.get();
waiting_for_events[awaiting_list_any].second = cur.release();
waiting_for_events[awaiting_list_any].first->Signal();
} else if (waiting_for_events.count(awaiting_list_any_window) > 0) {
waiting_for_events[awaiting_list_any_window].second = cur.get();
waiting_for_events[awaiting_list_any_window].second = cur.release();
waiting_for_events[awaiting_list_any_window].first->Signal();
}
waiting_for_events_mu->unlock();