Skip to content

Commit

Permalink
Fix use-after-free in QgsVectorLayerCache iterators
Browse files Browse the repository at this point in the history
We need to gracefully handle the situation where the cache
is deleted before the iterator, as these iterators require
the cache object
  • Loading branch information
nyalldawson committed Jul 13, 2024
1 parent 711c75d commit 4923a71
Show file tree
Hide file tree
Showing 3 changed files with 12 additions and 4 deletions.
4 changes: 2 additions & 2 deletions src/core/qgscachedfeatureiterator.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ bool QgsCachedFeatureIterator::fetchFeature( QgsFeature &f )
{
f.setValid( false );

if ( mClosed )
if ( mClosed || !mVectorLayerCache )
return false;

while ( mFeatureIdIterator != mFeatureIds.constEnd() )
Expand Down Expand Up @@ -168,7 +168,7 @@ QgsCachedFeatureWriterIterator::QgsCachedFeatureWriterIterator( QgsVectorLayerCa

bool QgsCachedFeatureWriterIterator::fetchFeature( QgsFeature &f )
{
if ( mClosed )
if ( mClosed || !mVectorLayerCache )
{
f.setValid( false );
return false;
Expand Down
6 changes: 4 additions & 2 deletions src/core/qgscachedfeatureiterator.h
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
#include "qgsfeature.h"
#include "qgsfeatureiterator.h"
#include "qgscoordinatetransform.h"
#include "qgsvectorlayercache.h"
#include <QPointer>

class QgsVectorLayerCache;

Expand Down Expand Up @@ -84,7 +86,7 @@ class CORE_EXPORT QgsCachedFeatureIterator : public QgsAbstractFeatureIterator
#endif

QList< QgsFeatureId > mFeatureIds;
QgsVectorLayerCache *mVectorLayerCache = nullptr;
QPointer< QgsVectorLayerCache > mVectorLayerCache = nullptr;
QList< QgsFeatureId >::ConstIterator mFeatureIdIterator;
QgsCoordinateTransform mTransform;
QgsRectangle mFilterRect;
Expand Down Expand Up @@ -140,7 +142,7 @@ class CORE_EXPORT QgsCachedFeatureWriterIterator : public QgsAbstractFeatureIter

private:
QgsFeatureIterator mFeatIt;
QgsVectorLayerCache *mVectorLayerCache = nullptr;
QPointer< QgsVectorLayerCache > mVectorLayerCache;
QgsFeatureIds mFids;
QgsCoordinateTransform mTransform;
QgsRectangle mFilterRect;
Expand Down
6 changes: 6 additions & 0 deletions tests/src/python/test_qgsvectorlayercache.py
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,12 @@ def testAllFeatureIds(self):
"""
pass

def testOpenIteratorAfterSourceRemoval(self):
"""
Skip this test -- the iterators from the cache CANNOT be used after the cache is deleted
"""
pass


if __name__ == '__main__':
unittest.main()

0 comments on commit 4923a71

Please sign in to comment.