From 1239336af00215172c94d5d2af3926a72ea998c3 Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Mon, 28 Nov 2016 16:50:25 +0100 Subject: Qt: fix heap-use-after-free when double-clicking a packet number On double-clicking a packet number, the current field item is invalidated by goToPacket. Skip the URL since a field can either have a URL or a frame number (but not both). Change-Id: I58e5445fa74071fa0fd203df77ebdecdd1478d31 Reviewed-on: https://code.wireshark.org/review/18971 Petri-Dish: Peter Wu Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu --- ui/qt/proto_tree.cpp | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'ui') diff --git a/ui/qt/proto_tree.cpp b/ui/qt/proto_tree.cpp index 18f041a681..8f81f06397 100644 --- a/ui/qt/proto_tree.cpp +++ b/ui/qt/proto_tree.cpp @@ -571,15 +571,13 @@ void ProtoTree::itemDoubleClick(QTreeWidgetItem *item, int) { fi = item->data(0, Qt::UserRole).value(); if (!fi || !fi->hfinfo) return; - if(fi->hfinfo->type == FT_FRAMENUM) { + if (fi->hfinfo->type == FT_FRAMENUM) { if (QApplication::queryKeyboardModifiers() & Qt::ShiftModifier) { emit openPacketInNewWindow(true); } else { emit goToPacket(fi->value.value.uinteger); } - } - - if(FI_GET_FLAG(fi, FI_URL) && IS_FT_STRING(fi->hfinfo->type)) { + } else if (FI_GET_FLAG(fi, FI_URL) && IS_FT_STRING(fi->hfinfo->type)) { gchar *url; url = fvalue_to_string_repr(NULL, &fi->value, FTREPR_DISPLAY, fi->hfinfo->display); if(url){ -- cgit v1.2.3