diff options
author | Julian Eisel <julian@blender.org> | 2020-11-02 23:47:08 +0300 |
---|---|---|
committer | Julian Eisel <julian@blender.org> | 2020-11-03 02:00:41 +0300 |
commit | a750acab78cf38ca8f010c4ac81ec948faa79dd5 (patch) | |
tree | 6603e8747261895ff1b9dc9768cf47be202fefd3 /source/blender/windowmanager/intern | |
parent | 9cfcc273194e6e9706fefaac739b3d73eca2f62f (diff) |
Fix possible use-after-free when closing Blender with File Browser open
I think there wasn't actually any issue currently, but only by luck. We still
passed around and NULL-checked a pointer to freed memory (the file operator,
`SpaceFile.op`) which is easy to break and should be avoided.
Noticed while testing D8598.
Diffstat (limited to 'source/blender/windowmanager/intern')
-rw-r--r-- | source/blender/windowmanager/intern/wm_event_system.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c index 4f2be59eb1a..a6b8eb9d3fd 100644 --- a/source/blender/windowmanager/intern/wm_event_system.c +++ b/source/blender/windowmanager/intern/wm_event_system.c @@ -1731,8 +1731,21 @@ void WM_event_remove_handlers(bContext *C, ListBase *handlers) BLI_assert(handler_base->type != 0); if (handler_base->type == WM_HANDLER_TYPE_OP) { wmEventHandler_Op *handler = (wmEventHandler_Op *)handler_base; + if (handler->op) { wmWindow *win = CTX_wm_window(C); + + if (handler->is_fileselect) { + /* Exit File Browsers refering to this handler/operator. */ + LISTBASE_FOREACH (wmWindow *, temp_win, &wm->windows) { + ScrArea *file_area = ED_fileselect_handler_area_find(temp_win, handler->op); + if (!file_area) { + continue; + } + ED_area_exit(C, file_area); + } + } + if (handler->op->type->cancel) { ScrArea *area = CTX_wm_area(C); ARegion *region = CTX_wm_region(C); |