beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-11-26 01:20:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

LibGfx: Fix crash due to vector resize in close_all_subpaths()

Browse source 
Since close_all_subpaths() appends while iterating, the vector can
end up being resized and the iterator invalidated. Previously, this
led to a crash/UAF in some cases.
This commit is contained in:
MacDue 2023-04-05 23:11:00 +01:00 committed by Linus Groh
parent 064ca625df
commit 26e56bdd08
Notes: sideshowbarker 2024-07-16 22:58:46 +09:00 
Author: https://github.com/MacDue
Commit: https://github.com/SerenityOS/serenity/commit/26e56bdd08
Pull-request: https://github.com/SerenityOS/serenity/pull/18212
Reviewed-by: https://github.com/Lubrsi
Reviewed-by: https://github.com/awesomekling
Reviewed-by: https://github.com/linusg
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
Userland/Libraries/LibGfx/Path.cpp
View file

@ -144,8 +144,10 @@ void Path::close_all_subpaths()
Optional<FloatPoint> cursor, start_of_subpath;
bool is_first_point_in_subpath { false };
for (auto& segment : m_segments) {
switch (segment->type()) {
auto segment_count = m_segments.size();
for (size_t i = 0; i < segment_count; i++) {
// Note: We need to use m_segments[i] as append_segment() may invalidate any references.
switch (m_segments[i]->type()) {
case Segment::Type::MoveTo: {
if (cursor.has_value() && !is_first_point_in_subpath) {
// This is a move from a subpath to another
@ -157,7 +159,7 @@ void Path::close_all_subpaths()
append_segment<LineSegment>(start_of_subpath.value());
}
is_first_point_in_subpath = true;
cursor = segment->point();
cursor = m_segments[i]->point();
break;
}
case Segment::Type::LineTo:
@ -168,7 +170,7 @@ void Path::close_all_subpaths()
start_of_subpath = cursor;
is_first_point_in_subpath = false;
}
cursor = segment->point();
cursor = m_segments[i]->point();
break;
case Segment::Type::Invalid:
VERIFY_NOT_REACHED();