Skip to content

Commit b153868

Browse files
jonathan-meierSyntevoAlex
authored andcommitted
Issue #486: [win32] Fix use-after-free in Pattern
The bitmap used to create a GDI+ texture brush must not be deleted until after the brush is no longer used.
1 parent bac39d2 commit b153868

File tree

1 file changed

+16
-5
lines changed
  • bundles/org.eclipse.swt/Eclipse SWT/win32/org/eclipse/swt/graphics

1 file changed

+16
-5
lines changed

bundles/org.eclipse.swt/Eclipse SWT/win32/org/eclipse/swt/graphics/Pattern.java

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ public class Pattern extends Resource {
5353
*/
5454
public long handle;
5555

56+
private Runnable bitmapDestructor;
57+
5658
/**
5759
* Constructs a new Pattern given an image. Drawing with the resulting
5860
* pattern will cause the image to be tiled over the resulting area.
@@ -91,12 +93,17 @@ public Pattern(Device device, Image image) {
9193
int width = Gdip.Image_GetWidth(img);
9294
int height = Gdip.Image_GetHeight(img);
9395
handle = Gdip.TextureBrush_new(img, Gdip.WrapModeTile, 0, 0, width, height);
94-
Gdip.Bitmap_delete(img);
95-
if (gdipImage[1] != 0) {
96-
long hHeap = OS.GetProcessHeap ();
97-
OS.HeapFree(hHeap, 0, gdipImage[1]);
96+
bitmapDestructor = () -> {
97+
Gdip.Bitmap_delete(img);
98+
if (gdipImage[1] != 0) {
99+
long hHeap = OS.GetProcessHeap ();
100+
OS.HeapFree(hHeap, 0, gdipImage[1]);
101+
}
102+
};
103+
if (handle == 0) {
104+
bitmapDestructor.run();
105+
SWT.error(SWT.ERROR_NO_HANDLES);
98106
}
99-
if (handle == 0) SWT.error(SWT.ERROR_NO_HANDLES);
100107
init();
101108
}
102109

@@ -235,6 +242,10 @@ void destroy() {
235242
break;
236243
}
237244
handle = 0;
245+
if (bitmapDestructor != null) {
246+
bitmapDestructor.run();
247+
bitmapDestructor = null;
248+
}
238249
}
239250

240251
/**

0 commit comments

Comments
 (0)