Welcome to mirror list, hosted at ThFree Co, Russian Federation.

git.blender.org/blender.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJulian Eisel <julian@blender.org>2020-11-02 23:47:08 +0300
committerJulian Eisel <julian@blender.org>2020-11-03 02:00:41 +0300
commita750acab78cf38ca8f010c4ac81ec948faa79dd5 (patch)
tree6603e8747261895ff1b9dc9768cf47be202fefd3 /source/blender/windowmanager
parent9cfcc273194e6e9706fefaac739b3d73eca2f62f (diff)
Fix possible use-after-free when closing Blender with File Browser open
I think there wasn't actually any issue currently, but only by luck. We still passed around and NULL-checked a pointer to freed memory (the file operator, `SpaceFile.op`) which is easy to break and should be avoided. Noticed while testing D8598.
Diffstat (limited to 'source/blender/windowmanager')
-rw-r--r--source/blender/windowmanager/intern/wm_event_system.c13
1 files changed, 13 insertions, 0 deletions
diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index 4f2be59eb1a..a6b8eb9d3fd 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -1731,8 +1731,21 @@ void WM_event_remove_handlers(bContext *C, ListBase *handlers)
BLI_assert(handler_base->type != 0);
if (handler_base->type == WM_HANDLER_TYPE_OP) {
wmEventHandler_Op *handler = (wmEventHandler_Op *)handler_base;
+
if (handler->op) {
wmWindow *win = CTX_wm_window(C);
+
+ if (handler->is_fileselect) {
+ /* Exit File Browsers refering to this handler/operator. */
+ LISTBASE_FOREACH (wmWindow *, temp_win, &wm->windows) {
+ ScrArea *file_area = ED_fileselect_handler_area_find(temp_win, handler->op);
+ if (!file_area) {
+ continue;
+ }
+ ED_area_exit(C, file_area);
+ }
+ }
+
if (handler->op->type->cancel) {
ScrArea *area = CTX_wm_area(C);
ARegion *region = CTX_wm_region(C);