From cb5156f08199a66a2bb4813f9ae1aea9598721c4 Mon Sep 17 00:00:00 2001 From: Murai Takashi Date: Fri, 13 Nov 2020 21:27:04 +0900 Subject: [PATCH] LayoutBuilder.h: Fix use after free Fix 'item' is used after delete. Pointed out by Clang Static Analyzer. Change-Id: I8eca3084c97b37015a2da1b96119a458d4eb9aa7 Reviewed-on: https://review.haiku-os.org/c/haiku/+/3392 Reviewed-by: Adrien Destugues Reviewed-by: John Scipione --- headers/os/interface/LayoutBuilder.h | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/headers/os/interface/LayoutBuilder.h b/headers/os/interface/LayoutBuilder.h index 4ba372c9d3..3601369f7f 100644 --- a/headers/os/interface/LayoutBuilder.h +++ b/headers/os/interface/LayoutBuilder.h @@ -1737,8 +1737,10 @@ Menu::AddItem(const char* label, BMessage* message, char shortcut, uint32 modifiers) { BMenuItem* item = new BMenuItem(label, message, shortcut, modifiers); - if (!fMenu->AddItem(item)) + if (!fMenu->AddItem(item)) { delete item; + item = NULL; + } return MenuItem(this->fParent, fMenu, item); } @@ -1758,8 +1760,10 @@ Menu::AddItem(const char* label, uint32 messageWhat, throw; } - if (!fMenu->AddItem(item)) + if (!fMenu->AddItem(item)) { delete item; + item = NULL; + } return MenuItem(this->fParent, fMenu, item); }