Fix use after free

This patchset fixes the following issue:
+------------------------------------------------------------------------------+
| ==widget_viewer_evas-native-itc==3806776==ERROR: AddressSanitizer:           |
|    heap-use-after-free on address 0x007fa4358e40 at pc 0x007fa9827128        |
|    bp 0x007fcebea590 sp 0x007fcebea5a8                                       |
|  READ of size 4 at 0x007fa4358e40 thread T0                                  |
|  #0 0x7fa9827124 in _tbm_surface_internal_is_valid                           |
|  #1 0x7fa9832398 in tbm_surface_internal_get_info                            |
|  #2 0x7fa9840300 in tbm_surface_get_info                                     |
|  #3 0x7f968f5f50 in eng_image_stride_get                                     |
|  #4 0x7faea78b2c in evas_object_image_size_set                               |
|  #5 0x7fab3d02a8 in screen_connector::Image::Update(                         |
|    std::shared_ptr<screen_connector::WlBuffer>)                              |
|                                                                              |
|  0x007fa4358e40 is located 0 bytes inside of 416-byte region                 |
|    [0x007fa4358e40,0x007fa4358fe0)                                           |
|  freed by thread T0 here:                                                    |
|  #0 0x7fb0237a48 in free                                                     |
|  #1 0x7fa9829e70 in _tbm_surface_internal_destroy                            |
|  #2 0x7fa9830ea4 in tbm_surface_internal_unref                               |
|  #3 0x7fab423a0c in screen_connector::WlBuffer::~WlBuffer()                  |
|  #4 0x7fab423a0c in screen_connector::WlBuffer::~WlBuffer()                  |
|  #5 0x7fab3d04c4 in std::Sp_counted_base<(_gnu_cxx::_Lock_policy)2>::        |
|    _M_release()                                                              |
|  #6 0x7fab3d04c4 in std::Sp_counted_base<(_gnu_cxx::_Lock_policy)2>::        |
|    _M_release()                                                              |
|  #7 0x7fab3d04c4 in std::_shared_count<(gnu_cxx::_Lock_policy)2>::           |
|    ~_shared_count()                                                          |
|  #8 0x7fab3d04c4 in std::_shared_ptr<screen_connector::WlBuffer,             |
|    (gnu_cxx::_Lock_policy)2>::~_shared_ptr()                                 |
|  #9 0x7fab3d04c4 in std::_shared_ptr<screen_connector::WlBuffer,             |
|    (gnu_cxx::_Lock_policy)2>::operator=(                                     |
|    std::shared_ptr<screen_connector::WlBuffer, (_gnu_cxx::_Lock_policy)2>&&) |
|  #10 0x7fab3d04c4 in std::shared_ptr<screen_connector::WlBuffer>::operator=( |
|    std::shared_ptr<screen_connector::WlBuffer>&&)                            |
|  #11 0x7fab3d04c4 in screen_connector::Image::Update(                        |
|    std::shared_ptr<screen_connector::WlBuffer>)                              |
+------------------------------------------------------------------------------+

Change-Id: Iab89eeb354c76431cb616cf6f041c8583c04c800
Signed-off-by: Hwankyu Jhun <h.jhun@samsung.com>

diff --git a/screen_connector_remote_surface_evas/image.cc b/screen_connector_remote_surface_evas/image.cc
index 2c2aeec..5d0c0c2 100644 (file)
--- a/screen_connector_remote_surface_evas/image.cc
+++ b/screen_connector_remote_surface_evas/image.cc
@@ -206,8 +206,8 @@ void Image::Update(std::shared_ptr<WlBuffer> tbm) {
   ns.data.tbm.buffer = tbmSurface;
 
   evas_object_resize(GetRaw(), width, height);
-  evas_object_image_size_set(GetRaw(), width, height);
   evas_object_image_native_surface_set(GetRaw(), &ns);
+  evas_object_image_size_set(GetRaw(), width, height);
   evas_object_image_pixels_dirty_set(GetRaw(), EINA_TRUE);
 }
 

diff --git a/screen_connector_remote_surface_evas/watcher_image.cc b/screen_connector_remote_surface_evas/watcher_image.cc
index 866d56b..282a9a8 100644 (file)
--- a/screen_connector_remote_surface_evas/watcher_image.cc
+++ b/screen_connector_remote_surface_evas/watcher_image.cc
@@ -51,8 +51,8 @@ void WatcherImage::UpdateTbm(std::shared_ptr<WlBuffer> tbm) {
   ns.data.tbm.buffer = tbmSurface;
 
   evas_object_resize(GetRaw(), width, height);
-  evas_object_image_size_set(GetRaw(), width, height);
   evas_object_image_native_surface_set(GetRaw(), &ns);
+  evas_object_image_size_set(GetRaw(), width, height);
   evas_object_image_pixels_dirty_set(GetRaw(), EINA_TRUE);
 }