Browse Source

TooltipWindow: Avoid potential use-after-free of lastComponentUnderMouse

Showing the tip will in turn call getDesktopScaleFactor(), accessing the
lastComponentUnderMouse. In some cases, it was possible for
lastComponentUnderMouse to point to a deleted component, resulting in
UB.

There are two changes in this PR:
- Using a SafePointer rather than a raw pointer ensures that calls to
  getDesktopScaleFactor() will always be safe, regardless of when they
  happen.
- Moving the assignment of lastComponentUnderMouse to before the call to
  displayTipInternal() ensures that the returned scale factor is that of
  the component that the mouse is currently hovering.
v6.1.6
reuk 3 years ago
parent
commit
eb8a419ac7
No known key found for this signature in database GPG Key ID: 9ADCD339CFC98A11
2 changed files with 4 additions and 4 deletions
  1. +3
    -3
      modules/juce_gui_basics/windows/juce_TooltipWindow.cpp
  2. +1
    -1
      modules/juce_gui_basics/windows/juce_TooltipWindow.h

+ 3
- 3
modules/juce_gui_basics/windows/juce_TooltipWindow.cpp View File

@@ -218,6 +218,9 @@ void TooltipWindow::timerCallback()
const auto tipChanged = (newTip != lastTipUnderMouse || newComp != lastComponentUnderMouse);
const auto now = Time::getApproximateMillisecondCounter();
lastComponentUnderMouse = newComp;
lastTipUnderMouse = newTip;
if (tipChanged || dismissalMouseEventOccurred || mouseMovedQuickly)
lastCompChangeTime = now;
@@ -246,9 +249,6 @@ void TooltipWindow::timerCallback()
showTip();
}
}
lastComponentUnderMouse = newComp;
lastTipUnderMouse = newTip;
}
}


+ 1
- 1
modules/juce_gui_basics/windows/juce_TooltipWindow.h View File

@@ -136,7 +136,7 @@ public:
private:
//==============================================================================
Point<float> lastMousePos;
Component* lastComponentUnderMouse = nullptr;
SafePointer<Component> lastComponentUnderMouse;
String tipShowing, lastTipUnderMouse, manuallyShownTip;
int millisecondsBeforeTipAppears;
unsigned int lastCompChangeTime = 0, lastHideTime = 0;


Loading…
Cancel
Save