Fix use-after-free when closing Discover

When closing Discover:

Changes:

  • Add m_isDeleting to avoid accessing freed memory during destruction.
  • Rename variables for readability.

BUG: 466619


Possible approaches

  1. Check DiscoverObject::m_isDeleting in openResourceOrWait().
  2. disconnect all QTimer at the start of DiscoverObject destruction.
  3. Swap the destruction order of ResourcesModel and DiscoverObject.
  4. Implement ResourcesModel::isModelNull() and check it in openResourceOrWait().
    ...

This Merge Request chooses Approach 1, because it is easy to implement.

Test

Steps to reproduce the crash (metioned in bug 477111):

  1. Press Win to open the Application Launcher.
  2. Right click an application in the Application Launcher, select Uninstall or Manage Add-Ons....
  3. Close the Discover when it is still loading.

Note: Steps 1-2 can be replaced with direct CLI execution:

plasma-discover appstream://org.kde.discover.desktop

After modification, Discover will not crash.

Limitations

With Approach 1, there is a low probability that the QTimer may be triggered during the destruction of ResourcesModel, potentially leading to a UAF. Approach 4 can avoid this issue.

Edited by Wendi Gan

Merge request reports

Loading