jpeg pushed a commit to branch master.
http://git.enlightenment.org/core/efl.git/commit/?id=f97920816d3e54fe0815d9d03777bbf747d54787
commit f97920816d3e54fe0815d9d03777bbf747d54787
Author: Youngbok Shin <youngb.s...@samsung.com>
Date: Fri May 12 14:17:30 2017 +0900
evas textblock: fix dereferenced memory after free issue for ellipsis
Summary:
_layout_ellipsis_item_new() function deallocates "ellip_ti" and
allocates memory for new one. The local "ellip_ti" pointer should be
updated.
@fix
Test Plan: N/A
Reviewers: raster, cedric, herdsman, jpeg, woohyun
Differential Revision: https://phab.enlightenment.org/D4854
---
src/lib/evas/canvas/evas_object_textblock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lib/evas/canvas/evas_object_textblock.c
b/src/lib/evas/canvas/evas_object_textblock.c
index 0555008..0a53730 100644
--- a/src/lib/evas/canvas/evas_object_textblock.c
+++ b/src/lib/evas/canvas/evas_object_textblock.c
@@ -5309,7 +5309,7 @@ _layout_par_ellipsis_items(Ctxt *c, double ellip)
off += it->adv;
}
c->o->ellip_prev_it = i;
- if (it) _layout_ellipsis_item_new(c, it);
+ if (it) ellip_ti = _layout_ellipsis_item_new(c, it);
pos = (it && it->type == EVAS_TEXTBLOCK_ITEM_TEXT) ?
--
