Mapper: Crash when closing map while text edit started

[dl3sdo]

Steps to reproduce

1. open e.g., sample map 'forest sample.omap'
2. select any text symbol
3. left click into map, so that the text editor box appears but don't enter anything
4. close map

Actual behaviour

Mapper crashes

Configuration

Mapper Version: 0.83, 0.9.0, master v20191108.3 (latest stable build) (all x64)
Operating System: Win7x64

[Symbian9]

Confirmed. Just reproduced under Linux - Mapper crashed silently immediately after click «Close» button in menu «File»

$ Mapper
Segmentation fault

Mapper version: v0.9.0 (release); v20191109.3 (master)
Operating System: Debian 9.x (x86_64)

[dg0yt]

@Symbian9 You may confirm, but not approve here.

[lpechacek]

Looks like use after free. Debug build spits out the following lines:

/data/src/oomapper/src/tools/tool.cpp:214:23: runtime error: member call on address 0x000002a49360 which does not point to an object of type 'MapEditorController'
0x000002a49360: note: object has a possibly invalid vptr: abs(offset to top) too big
 00 00 00 00  40 6e a9 03 00 00 00 00  10 03 a9 03 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              possibly invalid vptr
/data/src/oomapper/src/gui/map/map_editor.h:192:37: runtime error: member access within address 0x000002a49360 which does not point to an object of type 'MapEditorController'
0x000002a49360: note: object has a possibly invalid vptr: abs(offset to top) too big
 00 00 00 00  40 6e a9 03 00 00 00 00  10 03 a9 03 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              possibly invalid vptr

Which is the following code:

212 Map* MapEditorTool::map() const
213 {
214         return editor->getMap();
215 }

Called from MapEditorToolBase::updateDirtyRect.

1  OpenOrienteering::MapEditorToolBase::updateDirtyRect                     tool_base.cpp      333 0x14157b0      
2  OpenOrienteering::DrawTextTool::finishEditing                            draw_text_tool.cpp 164 0x1363ecc      
3  OpenOrienteering::DrawTextTool::~DrawTextTool                            draw_text_tool.cpp 76  0x135fbd7      
4  OpenOrienteering::DrawTextTool::~DrawTextTool                            draw_text_tool.cpp 77  0x135fe94      
5  QObject::event(QEvent *)                                                                        0x7ffff56f6d00 
6  QApplicationPrivate::notify_helper(QObject *, QEvent *)                                         0x7ffff7a68c62 
7  QApplication::notify(QObject *, QEvent *)                                                       0x7ffff7a721e0 
8  QCoreApplication::notifyInternal2(QObject *, QEvent *)                                          0x7ffff56cb572 
9  QCoreApplicationPrivate::sendPostedEvents(QObject *, int, QThreadData *)                        0x7ffff56ce208 
10 QCoreApplication::exec()                                                                        0x7ffff56d1d5b 
11 main                                                                     main.cpp           209 0x7f85fc       

[dg0yt]

DrawTextTool calls editor->setEditingInProgress(...) directly rather than going through its inherited methods. That's why tearing down the map editor doesn't find out that the tool is in editing state, doesn't call finishEditing() and finally runs into an unexpected use after free.

[lpechacek]

I can see you are a step ahead of me in the analysis, Kai. Assume you will also produce the fix. Feel free to reassign to me in cas you are not going to work on it.