Embedded/lvgl
1
0
Fork 0
mirror of https://github.com/lvgl/lvgl.git synced 2025-01-28 07:03:00 +08:00
Code Issues Projects Releases Wiki Activity

fix(anim_timeline) heap use after free (#2394)

Browse Source
This commit is contained in:
_VIFEXTech 2021-07-22 21:19:08 +08:00 committed by GitHub
parent 95bf16952e
commit bfab70802e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/misc/lv_anim_timeline.c
View File

@ -19,14 +19,13 @@
**********************/
/*Data of anim_timeline_dsc*/
typedef struct{
typedef struct {
lv_anim_t anim;
lv_anim_t * new_anim;
uint32_t start_time;
}lv_anim_timeline_dsc_t;
} lv_anim_timeline_dsc_t;
/*Data of anim_timeline*/
struct _lv_anim_timeline_t{
struct _lv_anim_timeline_t {
lv_anim_timeline_dsc_t * anim_dsc; /**< Dynamically allocated anim dsc array*/
uint32_t anim_dsc_cnt; /**< The length of anim dsc array*/
bool reverse; /**< Reverse playback*/
@ -65,7 +64,7 @@ void lv_anim_timeline_del(lv_anim_timeline_t * at)
for(uint32_t i = 0; i < at->anim_dsc_cnt; i++) {
lv_anim_t * a = &(at->anim_dsc[i].anim);
lv_anim_custom_del(at->anim_dsc[i].new_anim, (lv_anim_custom_exec_cb_t)a->exec_cb);
lv_anim_custom_del(a, (lv_anim_custom_exec_cb_t)a->exec_cb);
}
lv_mem_free(at->anim_dsc);
@ -82,7 +81,6 @@ void lv_anim_timeline_add(lv_anim_timeline_t * at, uint32_t start_time, lv_anim_
LV_ASSERT_MALLOC(at->anim_dsc);
at->anim_dsc[at->anim_dsc_cnt - 1].anim = *a;
at->anim_dsc[at->anim_dsc_cnt - 1].new_anim = NULL;
at->anim_dsc[at->anim_dsc_cnt - 1].start_time = start_time;
}
@ -107,7 +105,7 @@ uint32_t lv_anim_timeline_start(lv_anim_timeline_t * at)
lv_anim_set_delay(&a, start_time);
}
at->anim_dsc[i].new_anim = lv_anim_start(&a);
lv_anim_start(&a);
}
return playtime;