Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] PSA: QString.toUtf8().constData() pattern is unsafe

From: Peter Wu <peter@xxxxxxxxxxxxx>
Date: Fri, 28 Nov 2014 20:13:26 +0100
Hi all,

I mostly use Wireshark GTK, but just tried the Qt UI again. A recurring
problem was an ASAN crash on shutdown. It turns out that there are many
users of this pattern:

    recent_add_cfilter(NULL, currentText().toUtf8().constData());

This is unsafe as currentText().toUtf8() returns a new instance of
QByteArray and constData() returns a pointer to data inside that object.
After returning, the data is destructed and a use-after-free condition
occurs.

The more correct way to do this is to use another variable to ensure
that a reference is held to that QByteArray:

    QByteArray text_utf8 = currentText().toUtf8();
    recent_add_cfilter(NULL, text_utf8.constData());

See also the commit message at https://code.wireshark.org/review/5528/
Please avoid this pattern in the future, and watch it during reviews.
-- 
Kind regards,
Peter
https://lekensteyn.nl