Skip to content

Fix invalid read in ProgramFactory::load()

Steps to reproduce

  • delete ~/.local/share/KDE/telly-skout
  • start Telly Skout
  • select at least 2 favorites
  • open "Favorites" page

valgrind output:

==1471097== Invalid read of size 8
==1471097==    at 0x159178: QMap<QStringId<ChannelTag>, QVector<ProgramData> >::contains(QStringId<ChannelTag> const&) const (qmap.h:707)
==1471097==    by 0x15E189: ProgramFactory::load(QStringId<ChannelTag> const&) const (programfactory.cpp:46)
==1471097==    by 0x15E5BB: ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}::operator()(QStringId<ChannelTag> const&) const (programsmodel.cpp:23)
==1471097==    by 0x15EDEB: QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QStringId<ChannelTag> const&>, void, ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}>::call(ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}&, void**) (qobjectdefs_impl.h:146)
==1471097==    by 0x15EDAF: void QtPrivate::Functor<ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}, 1>::call<QtPrivate::List<QStringId<ChannelTag> const&>, void>(ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}&, void*, void**) (qobjectdefs_impl.h:256)
==1471097==    by 0x15ED7E: QtPrivate::QFunctorSlotObject<ProgramsModel::ProgramsModel(Channel*, ProgramFactory&)::{lambda(QStringId<ChannelTag> const&)#1}, 1, QtPrivate::List<QStringId<ChannelTag> const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobjectdefs_impl.h:443)
==1471097==    by 0x65F4462: UnknownInlinedFun (qobjectdefs_impl.h:398)
==1471097==    by 0x65F4462: void doActivate<false>(QObject*, int, void**) (qobject.cpp:3886)
==1471097==    by 0x1395A5: Fetcher::channelUpdated(QStringId<ChannelTag> const&) (moc_fetcher.cpp:300)
==1471097==    by 0x15B173: Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}::operator()(QStringId<ChannelTag> const&) const (fetcher.cpp:47)
==1471097==    by 0x15D4F3: QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QStringId<ChannelTag> const&>, void, Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}>::call(Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}&, void**) (qobjectdefs_impl.h:146)
==1471097==    by 0x15D289: void QtPrivate::Functor<Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}, 1>::call<QtPrivate::List<QStringId<ChannelTag> const&>, void>(Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}&, void*, void**) (qobjectdefs_impl.h:256)
==1471097==    by 0x15CEA6: QtPrivate::QFunctorSlotObject<Fetcher::Fetcher()::{lambda(QStringId<ChannelTag> const&)#4}, 1, QtPrivate::List<QStringId<ChannelTag> const&>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) (qobjectdefs_impl.h:443)
==1471097==  Address 0xa404940 is 80 bytes inside a block of size 232 free'd
==1471097==    at 0x48488AF: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1471097==    by 0x145C6B: QQmlPrivate::QQmlElement<ChannelsModel>::operator delete(void*) (qqmlprivate.h:151)
==1471097==    by 0x145BBF: QQmlPrivate::QQmlElement<ChannelsModel>::~QQmlElement() (qqmlprivate.h:144)
==1471097==    by 0x65EA614: QObjectPrivate::deleteChildren() (qobject.cpp:2104)
==1471097==    by 0x65EADC8: QObject::~QObject() (qobject.cpp:1082)
==1471097==    by 0x549D8CA: UnknownInlinedFun (qqmlprivate.h:144)
==1471097==    by 0x549D8CA: QQmlPrivate::QQmlElement<QQuickListView>::~QQmlElement() [clone .lto_priv.0] (qqmlprivate.h:144)
==1471097==    by 0x65EA614: QObjectPrivate::deleteChildren() (qobject.cpp:2104)
==1471097==    by 0x65EADC8: QObject::~QObject() (qobject.cpp:1082)
==1471097==    by 0x10D5ADAA: UnknownInlinedFun (qqmlprivate.h:144)
==1471097==    by 0x10D5ADAA: QQmlPrivate::QQmlElement<QQuickPage>::~QQmlElement() (qqmlprivate.h:144)
==1471097==    by 0x65E75D6: QObject::event(QEvent*) (qobject.cpp:1301)
==1471097==    by 0x4BA62C5: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3637)
==1471097==    by 0x65C35A9: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1064)
==1471097==  Block was alloc'd at
==1471097==    at 0x4846013: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==1471097==    by 0x590D3C2: UnknownInlinedFun (qqmltype.cpp:498)
==1471097==    by 0x590D3C2: QQmlType::create(QObject**, void**, unsigned long) const (qqmltype.cpp:491)
==1471097==    by 0x5954933: QQmlObjectCreator::createInstance(int, QObject*, bool) (qqmlobjectcreator.cpp:1189)
==1471097==    by 0x5956501: QQmlObjectCreator::setPropertyBinding(QQmlPropertyData const*, QV4::CompiledData::Binding const*) (qqmlobjectcreator.cpp:847)
==1471097==    by 0x5956AF7: QQmlObjectCreator::setupBindings(bool) (qqmlobjectcreator.cpp:798)
==1471097==    by 0x595372A: QQmlObjectCreator::populateInstance(int, QObject*, QObject*, QQmlPropertyData const*) (qqmlobjectcreator.cpp:1555)
==1471097==    by 0x595430E: QQmlObjectCreator::createInstance(int, QObject*, bool) (qqmlobjectcreator.cpp:1348)
==1471097==    by 0x5956501: QQmlObjectCreator::setPropertyBinding(QQmlPropertyData const*, QV4::CompiledData::Binding const*) (qqmlobjectcreator.cpp:847)
==1471097==    by 0x5956AF7: QQmlObjectCreator::setupBindings(bool) (qqmlobjectcreator.cpp:798)
==1471097==    by 0x595372A: QQmlObjectCreator::populateInstance(int, QObject*, QObject*, QQmlPropertyData const*) (qqmlobjectcreator.cpp:1555)
==1471097==    by 0x595430E: QQmlObjectCreator::createInstance(int, QObject*, bool) (qqmlobjectcreator.cpp:1348)
==1471097==    by 0x594E552: QQmlObjectCreator::create(int, QObject*, QQmlInstantiationInterrupt*, int) (qqmlobjectcreator.cpp:204)
Edited by Plata Hill