Skip to content

fix: free export log buffers with array delete - #571

Closed
pengfeixx wants to merge 1 commit into
linuxdeepin:masterfrom
pengfeixx:fix/export-buffer-array-delete
Closed

pengfeixx wants to merge 1 commit into
linuxdeepin:masterfrom
pengfeixx:fix/export-buffer-array-delete

Conversation

@pengfeixx

@pengfeixx pengfeixx commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Problem

The UT server run (tests/test-prj-running.sh, ASan on) aborted the whole deepin-log-viewer-test binary at UT_DLDBusHandler.exportLog_home_file_copy_succeeds:

ERROR: AddressSanitizer: alloc-dealloc-mismatch (operator new [] vs operator delete)
    #3 DLDBusHandler::exportLog(...) application/dbusproxy/dldbushandler.cpp:376

Because the process aborted, no gcov data was flushed for the main suite, so the reported coverage collapsed to the plugin binary's numbers (66 tests, ~10% lines).

Root cause

Three export paths allocate copy buffers with new char[] but hold them in QScopedPointer<char>, whose destructor calls scalar delete — undefined behavior:

  • application/dbusproxy/dldbushandler.cpp:356
  • logViewerService/logviewerservice.cpp:1256
  • logViewerService/logviewerservice.cpp:1430

(The latter two are the same defect flagged by the earlier Mode-5 review of exportLog.)

Fix

Switch to QScopedArrayPointer<char> (same header, frees with delete[]); data() usage unchanged. No ASan option masking needed.

Verified: the crashing test plus the LogViewerService export tests (8 cases total) pass with plain ASAN_OPTIONS=detect_leaks=0.

Summary by Sourcery

Correct export buffer ownership so log export paths safely release dynamically allocated arrays and no longer abort under AddressSanitizer.

Bug Fixes:

  • Fix AddressSanitizer alloc/dealloc mismatches when exporting logs by using array-aware buffer cleanup.

Tests:

  • Verify the DBus and log service export paths with AddressSanitizer-enabled tests.

Three export paths allocated copy buffers with new char[] but held
them in QScopedPointer<char>, whose destructor calls scalar delete —
an alloc-dealloc mismatch (undefined behavior). Under the UT script's
AddressSanitizer run this aborted the whole test binary at
UT_DLDBusHandler.exportLog_home_file_copy_succeeds, so the main suite
contributed no results and reported coverage collapsed to the plugin
binary's numbers.

Switch to QScopedArrayPointer<char> so the buffers are freed with
delete[]:

- application/dbusproxy/dldbushandler.cpp:356 (home-path file copy)
- logViewerService/logviewerservice.cpp:1256 (exportLog copy loop)
- logViewerService/logviewerservice.cpp:1430 (large buffered export)

Verified: the crashing test plus the LogViewerService export tests
(8 cases) now pass with plain ASAN_OPTIONS=detect_leaks=0.
@sourcery-ai

sourcery-ai Bot commented Oct 28, 2026

Copy link
Copy Markdown

Sorry @pengfeixx, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 hour and 13 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: pengfeixx

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sourcery-ai

sourcery-ai Bot commented Oct 28, 2026

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Fixes an AddressSanitizer alloc/dealloc mismatch by changing three 1 MiB export buffers from QScopedPointer to QScopedArrayPointer, ensuring allocations made with new[] are released with delete[] while leaving export behavior unchanged.

File-Level Changes

Change Details Files
Correct ownership semantics for heap-allocated export buffers.
  • Replace scalar-deleting scoped pointers with array-deleting scoped pointers for all three export paths.
  • Preserve existing buffer allocation size, data access, and copy-loop behavior.
application/dbusproxy/dldbushandler.cpp
logViewerService/logviewerservice.cpp
Verify the fix under AddressSanitizer without suppressing the allocator mismatch.
  • Run the previously crashing DBus export test and LogViewerService export tests.
  • Confirm eight export-related cases pass with leak detection disabled only.
tests/test-prj-running.sh

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

🤖 AI 代码审查报告

总体评分: 100 分 (通过阈值: 70分)

Pass


📊 总体评价

项目 结果
审查结论 代码审查通过
评分详情 本次提交修复了三处使用 QScopedPointer 管理 new[] 分配数组内存的未定义行为问题,改为正确的 QScopedArrayPointer,变更精准、逻辑正确、无安全漏洞引入。

🔍 详细分析

1. 语法逻辑 ✅

评价: 语法正确,逻辑清晰 ✅ 通过

潜在问题:
✅ 未发现明显问题

建议: []


2. 代码质量 ✅

评价: 代码结构清晰,注释完整 ✅ 通过

潜在问题:
✅ 未发现明显问题

建议: []


3. 代码性能 ✅

评价: 性能良好,资源使用合理 ✅ 通过

潜在问题:
✅ 未发现明显问题

建议: []


4. 代码安全 🔒

评价: 存在0个安全漏洞 ✅ 通过

🔐 发现 0 个安全漏洞

安全漏洞详情:
✅ 未发现安全漏洞

建议: []


💡 改进建议代码示例

// 修复方式已正确,无需额外修改。以下是正确的用法示例:
#include <QScopedArrayPointer>

// 正确:QScopedArrayPointer 使用 delete[] 释放 new[] 分配的数组
QScopedArrayPointer<char> buffer(new char[chunkSize]);

// 错误(原代码):QScopedPointer 使用 delete 释放,与 new[] 不匹配
// QScopedPointer<char> buffer(new char[chunkSize]);

本报告由 AI 代码审查工具自动生成

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants