Fix use-after-free when closing Discover
When closing Discover:
- First,
ResourcesModel::~ResourcesModel()is called, withAbstractResource(child object ofAbstractResourcesBackend) freed. - Next,
DiscoverObject::~DiscoverObject()is called, with its child objecttimeoutdestroyed. Then,openResourceOrWait()is invoked, andres.resource->isInstalled()accesses freed memory (use-after-free).
Changes:
- Add
m_isDeletingto avoid accessing freed memory during destruction. - Rename variables for readability.
Possible approaches
- Check
DiscoverObject::m_isDeletinginopenResourceOrWait(). -
disconnectallQTimerat the start ofDiscoverObjectdestruction. - Swap the destruction order of
ResourcesModelandDiscoverObject. - Implement
ResourcesModel::isModelNull()and check it inopenResourceOrWait().
...
This Merge Request chooses Approach 1, because it is easy to implement.
Test
Steps to reproduce the crash (metioned in bug 477111):
- Press
Winto open the Application Launcher. - Right click an application in the Application Launcher, select
Uninstall or Manage Add-Ons.... - Close the Discover when it is still loading.
Note: Steps 1-2 can be replaced with direct CLI execution:
plasma-discover appstream://org.kde.discover.desktop
After modification, Discover will not crash.
Limitations
With Approach 1, there is a low probability that the QTimer may be triggered during the destruction of ResourcesModel, potentially leading to a UAF. Approach 4 can avoid this issue.
Edited by Wendi Gan