From: Tom Hacohen <tom@stosb.com>
Date: Sun, 17 Apr 2011 08:38:29 +0000 (+0000)
Subject: Evas textblock: Fixed an invalid read.
X-Git-Tag: submit/devel/efl/20131022.203902~9896
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e6be4f7deb00a323e134240a15159dbbc5514aca;p=platform%2Fupstream%2Fefl.git

Evas textblock: Fixed an invalid read.

In some cases an invalid read would occur. This was because we didn't
handle node merging appropriately.

SVN revision: 58701
---

diff --git a/legacy/evas/src/lib/canvas/evas_object_textblock.c b/legacy/evas/src/lib/canvas/evas_object_textblock.c
index 86a6084..935c124 100644
--- a/legacy/evas/src/lib/canvas/evas_object_textblock.c
+++ b/legacy/evas/src/lib/canvas/evas_object_textblock.c
@@ -1912,7 +1912,8 @@ _paragraph_free(const Evas_Object *obj, Evas_Object_Textblock_Paragraph *par)
    if (par->bidi_props)
       evas_bidi_paragraph_props_unref(par->bidi_props);
 #endif
-   if (par->text_node)
+   /* If we are the active par of the text node, set to NULL */
+   if (par->text_node && (par->text_node->par == par))
       par->text_node->par = NULL;
    free(par);
 }
@@ -4781,6 +4782,14 @@ _evas_textblock_nodes_merge(Evas_Object_Textblock *o, Evas_Object_Textblock_Node
         to->format_node = from->format_node;
      }
 
+   /* When it comes to how we handle it, merging is like removing both nodes
+    * and creating a new one, se we need to do the needed cleanups. */
+   if (to->par)
+      to->par->text_node = NULL;
+   to->par = NULL;
+
+   to->new = EINA_TRUE;
+
    _evas_textblock_cursors_set_node(o, from, to);
    _evas_textblock_node_text_remove(o, from);
 }