Skip to content

heap-use-after-free in NoteListView on exit #732

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
zjeffer opened this issue Jan 19, 2025 · 0 comments
Open

heap-use-after-free in NoteListView on exit #732

zjeffer opened this issue Jan 19, 2025 · 0 comments
Labels
Bug

Comments

@zjeffer
Copy link
Collaborator

zjeffer commented Jan 19, 2025 •
edited
Loading

Not sure how to reproduce it yet.

==90321==ERROR: AddressSanitizer: heap-use-after-free on address 0x506000db2378 at pc 0x64db617a8582 bp 0x7ffeeaa867d0 sp 0x7ffeeaa867c8
READ of size 8 at 0x506000db2378 thread T0
    #0 0x64db617a8581 in std::_Rb_tree<int, std::pair<int const, QList<QWidget*>>, std::_Select1st<std::pair<int const, QList<QWidget*>>>, std::less<int>, std::allocator<std::pair<int const, QList<QWidget*>>>>::_M_begin() const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/14.2.1/../../../../include/c++/14.2.1/bits/stl_tree.h:743:29
    #1 0x64db617a8272 in std::_Rb_tree<int, std::pair<int const, QList<QWidget*>>, std::_Select1st<std::pair<int const, QList<QWidget*>>>, std::less<int>, std::allocator<std::pair<int const, QList<QWidget*>>>>::find(int const&) const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/14.2.1/../../../../include/c++/14.2.1/bits/stl_tree.h:2541:43
    #2 0x64db617a813c in std::map<int, QList<QWidget*>, std::less<int>, std::allocator<std::pair<int const, QList<QWidget*>>>>::find(int const&) const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/14.2.1/../../../../include/c++/14.2.1/bits/stl_map.h:1244:21
    #3 0x64db6179b732 in QMap<int, QList<QWidget*>>::contains(int const&) const /usr/include/qt6/QtCore/qmap.h:346:23
    #4 0x64db6178ae2e in NoteListView::unsetEditorWidget(int, QWidget*) /home/zjeffer/git/notes/src/notelistview.cpp:196:24
    #5 0x64db6175621b in NoteListDelegateEditor::~NoteListDelegateEditor() /home/zjeffer/git/notes/src/notelistdelegateeditor.cpp:141:13
    #6 0x64db617562e8 in NoteListDelegateEditor::~NoteListDelegateEditor() /home/zjeffer/git/notes/src/notelistdelegateeditor.cpp:140:1
    #7 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #8 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #9 0x739051f39434 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1587:1
    #10 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #11 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #12 0x64db61788eb2 in NoteListView::~NoteListView() /home/zjeffer/git/notes/src/notelistview.cpp:92:1
    #13 0x64db61789428 in NoteListView::~NoteListView() /home/zjeffer/git/notes/src/notelistview.cpp:89:1
    #14 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #15 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #16 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #17 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #18 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #19 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #20 0x739052118ab4 in QSplitter::~QSplitter() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qsplitter.cpp:951:1
    #21 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #22 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #23 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #24 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #25 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #26 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #27 0x739051f39434 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1587:1
    #28 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #29 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #30 0x64db616529cb in MainWindow::~MainWindow() /home/zjeffer/git/notes/src/mainwindow.cpp:358:1
    #31 0x64db616286d3 in main /home/zjeffer/git/notes/src/main.cpp:104:1
    #32 0x739050034e07 in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #33 0x739050034ecb in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #34 0x64db61365584 in _start (/home/zjeffer/git/notes/build/notes+0x113584) (BuildId: bf2bccd3a7175728e0e3d2a467a59e24404d9f9d)

0x506000db2378 is located 24 bytes inside of 56-byte region [0x506000db2360,0x506000db2398)
freed by thread T0 here:
    #0 0x64db614a50f2 in operator delete(void*, unsigned long) (/home/zjeffer/git/notes/build/notes+0x2530f2) (BuildId: bf2bccd3a7175728e0e3d2a467a59e24404d9f9d)
    #1 0x64db6179e44f in QtPrivate::QExplicitlySharedDataPointerV2<QMapData<std::map<int, QList<QWidget*>, std::less<int>, std::allocator<std::pair<int const, QList<QWidget*>>>>>>::~QExplicitlySharedDataPointerV2() /usr/include/qt6/QtCore/qshareddata_impl.h:68:13
    #2 0x64db6179ae74 in QMap<int, QList<QWidget*>>::~QMap() /usr/include/qt6/QtCore/qabstractitemmodel.h:255:37
    #3 0x64db61788e79 in NoteListView::~NoteListView() /home/zjeffer/git/notes/src/notelistview.cpp:92:1
    #4 0x64db61789428 in NoteListView::~NoteListView() /home/zjeffer/git/notes/src/notelistview.cpp:89:1
    #5 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #6 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #7 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #8 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #9 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #10 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #11 0x739052118ab4 in QSplitter::~QSplitter() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qsplitter.cpp:951:1
    #12 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #13 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #14 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #15 0x739051fe6888 in QFrame::~QFrame() /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:235:1
    #16 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #17 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #18 0x739051f39434 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1587:1
    #19 0x73905079bdca in QObjectPrivate::deleteChildren() /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2211:16
    #20 0x739051f39370 in QWidget::~QWidget() /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1560:26
    #21 0x64db616529cb in MainWindow::~MainWindow() /home/zjeffer/git/notes/src/mainwindow.cpp:358:1
    #22 0x64db616286d3 in main /home/zjeffer/git/notes/src/main.cpp:104:1
    #23 0x739050034e07 in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #24 0x739050034ecb in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #25 0x64db61365584 in _start (/home/zjeffer/git/notes/build/notes+0x113584) (BuildId: bf2bccd3a7175728e0e3d2a467a59e24404d9f9d)

previously allocated by thread T0 here:
    #0 0x64db614a41b2 in operator new(unsigned long) (/home/zjeffer/git/notes/build/notes+0x2521b2) (BuildId: bf2bccd3a7175728e0e3d2a467a59e24404d9f9d)
    #1 0x64db6179fff3 in QMap<int, QList<QWidget*>>::detach() /usr/include/qt6/QtCore/qmap.h:277:21
    #2 0x64db6179b0ba in QMap<int, QList<QWidget*>>::operator[](int const&) /usr/include/qt6/QtCore/qmap.h:371:9
    #3 0x64db6178a58f in NoteListView::openPersistentEditorC(QModelIndex const&) /home/zjeffer/git/notes/src/notelistview.cpp:170:13
    #4 0x64db615fed2f in ListViewLogic::onAddTagRequest(QModelIndex const&, int) /home/zjeffer/git/notes/src/listviewlogic.cpp:378:21
    #5 0x64db616083d6 in ListViewLogic::onAddTagRequestD(int, int) /home/zjeffer/git/notes/src/listviewlogic.cpp:388:5
    #6 0x64db6161a1b9 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (ListViewLogic::*)(int, int)>::call(void (ListViewLogic::*)(int, int), ListViewLogic*, void**)::'lambda'()::operator()() const /usr/include/qt6/QtCore/qobjectdefs_impl.h:152:24
    #7 0x64db61619f28 in void QtPrivate::FunctorCallBase::call_internal<void, QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (ListViewLogic::*)(int, int)>::call(void (ListViewLogic::*)(int, int), ListViewLogic*, void**)::'lambda'()>(void**, QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (ListViewLogic::*)(int, int)>::call(void (ListViewLogic::*)(int, int), ListViewLogic*, void**)::'lambda'()&&) /usr/include/qt6/QtCore/qobjectdefs_impl.h:65:17
    #8 0x64db61619e4d in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (ListViewLogic::*)(int, int)>::call(void (ListViewLogic::*)(int, int), ListViewLogic*, void**) /usr/include/qt6/QtCore/qobjectdefs_impl.h:151:13
    #9 0x64db61619bec in void QtPrivate::FunctionPointer<void (ListViewLogic::*)(int, int)>::call<QtPrivate::List<int, int>, void>(void (ListViewLogic::*)(int, int), ListViewLogic*, void**) /usr/include/qt6/QtCore/qobjectdefs_impl.h:199:13
    #10 0x64db61619a94 in QtPrivate::QCallableObject<void (ListViewLogic::*)(int, int), QtPrivate::List<int, int>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/qt6/QtCore/qobjectdefs_impl.h:570:21
    #11 0x7390507b1b28 in QtPrivate::QSlotObjectBase::call(QObject*, void**) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:486:57
    #12 0x7390507b1b28 in void doActivate<false>(QObject*, int, void**) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4124:30
    #13 0x64db614d3afc in TreeViewLogic::addNoteToTag(int, int) /home/zjeffer/git/notes/build/Notes_autogen/UVLADIE3JM/moc_treeviewlogic.cpp:352:5
    #14 0x64db617e0b09 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (TreeViewLogic::*)(int, int)>::call(void (TreeViewLogic::*)(int, int), TreeViewLogic*, void**)::'lambda'()::operator()() const /usr/include/qt6/QtCore/qobjectdefs_impl.h:152:24
    #15 0x64db617e0878 in void QtPrivate::FunctorCallBase::call_internal<void, QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (TreeViewLogic::*)(int, int)>::call(void (TreeViewLogic::*)(int, int), TreeViewLogic*, void**)::'lambda'()>(void**, QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (TreeViewLogic::*)(int, int)>::call(void (TreeViewLogic::*)(int, int), TreeViewLogic*, void**)::'lambda'()&&) /usr/include/qt6/QtCore/qobjectdefs_impl.h:65:17
    #16 0x64db617e079d in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1>, QtPrivate::List<int, int>, void, void (TreeViewLogic::*)(int, int)>::call(void (TreeViewLogic::*)(int, int), TreeViewLogic*, void**) /usr/include/qt6/QtCore/qobjectdefs_impl.h:151:13
    #17 0x64db617e053c in void QtPrivate::FunctionPointer<void (TreeViewLogic::*)(int, int)>::call<QtPrivate::List<int, int>, void>(void (TreeViewLogic::*)(int, int), TreeViewLogic*, void**) /usr/include/qt6/QtCore/qobjectdefs_impl.h:199:13
    #18 0x64db617e03e4 in QtPrivate::QCallableObject<void (TreeViewLogic::*)(int, int), QtPrivate::List<int, int>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) /usr/include/qt6/QtCore/qobjectdefs_impl.h:570:21
    #19 0x7390507b1b28 in QtPrivate::QSlotObjectBase::call(QObject*, void**) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobjectdefs_impl.h:486:57
    #20 0x7390507b1b28 in void doActivate<false>(QObject*, int, void**) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:4124:30
    #21 0x64db614c37cc in NodeTreeView::addNoteToTag(int, int) /home/zjeffer/git/notes/build/Notes_autogen/UVLADIE3JM/moc_nodetreeview.cpp:625:5
    #22 0x64db61708ede in NodeTreeView::dropEvent(QDropEvent*) /home/zjeffer/git/notes/src/nodetreeview.cpp:375:30
    #23 0x739051f4f5f2 in QWidget::event(QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:9172:18
    #24 0x739051fee137 in QFrame::event(QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:521:33
    #25 0x739050754a07 in QCoreApplicationPrivate::sendThroughObjectEventFilters(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1307:33
    #26 0x739051efe779 in QApplicationPrivate::notify_helper(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3290:38
    #27 0x739051f02dab in QApplication::notify(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3058:35
    #28 0x739050757ac7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1168:24
    #29 0x739051f6bb64 in QWidgetWindow::handleDropEvent(QDropEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidgetwindow.cpp:1019:34
    #30 0x739051f6bb64 in QWidgetWindow::event(QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidgetwindow.cpp:341:24
    #31 0x739051efe789 in QApplicationPrivate::notify_helper(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qapplication.cpp:3296:31
    #32 0x739050757ac7 in QCoreApplication::notifyInternal2(QObject*, QEvent*) /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qcoreapplication.cpp:1168:24

SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/qt6/QtCore/qmap.h:346:23 in QMap<int, QList<QWidget*>>::contains(int const&) const
Shadow bytes around the buggy address:
  0x506000db2080: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x506000db2100: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x506000db2180: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x506000db2200: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fa
  0x506000db2280: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
=>0x506000db2300: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd[fd]
  0x506000db2380: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x506000db2400: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
  0x506000db2480: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x506000db2500: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x506000db2580: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==90321==ABORTING
@zjeffer zjeffer added the Bug label Jan 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@zjeffer