From eff59f7bba4486b3a2da97b1078eee0465d3cc8d Mon Sep 17 00:00:00 2001 From: Niklas Fiekas Date: Sun, 23 Jun 2024 12:54:21 +0200 Subject: [PATCH] fix(indev): fix use after free of last hovered object (#6405) --- src/core/lv_obj_tree.c | 3 +++ tests/src/test_cases/test_hover.c | 16 +++++++++------- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/core/lv_obj_tree.c b/src/core/lv_obj_tree.c index f44aad736..f5e764b64 100644 --- a/src/core/lv_obj_tree.c +++ b/src/core/lv_obj_tree.c @@ -537,6 +537,9 @@ static void obj_delete_core(lv_obj_t * obj) if(indev->pointer.last_pressed == obj) { indev->pointer.last_pressed = NULL; } + if(indev->pointer.last_hovered == obj) { + indev->pointer.last_hovered = NULL; + } } if(indev->group == group && obj == lv_indev_get_active_obj()) { diff --git a/tests/src/test_cases/test_hover.c b/tests/src/test_cases/test_hover.c index 9396322b4..e5f860e93 100644 --- a/tests/src/test_cases/test_hover.c +++ b/tests/src/test_cases/test_hover.c @@ -81,14 +81,16 @@ void test_hover_basic(void) void test_hover_delete(void) { - lv_obj_t * button = lv_button_create(lv_screen_active()); - lv_obj_set_size(button, 200, 100); + for(int i = 0; i < 4; i++) { + lv_obj_t * btn = lv_button_create(lv_screen_active()); + lv_obj_set_size(btn, 200, 100); - lv_test_indev_wait(50); - lv_test_mouse_move_to(50, 50); - lv_test_indev_wait(50); - lv_obj_delete(button); /*No crash while deleting the hovered button*/ - lv_test_indev_wait(50); + lv_test_mouse_move_to(i * 10, 50); + lv_test_indev_wait(50); + + lv_obj_delete(btn); /*No crash while deleting the hovered button*/ + lv_test_indev_wait(50); + } }