From 0bef444337cd0fb79c22c1d1b98777976ea043d5 Mon Sep 17 00:00:00 2001 From: xiepengfei Date: Fri, 18 Sep 2026 19:25:13 +0800 Subject: [PATCH] fix: fix null pointer dereference in removeAllAnnotation guard condition The guard condition in removeAllAnnotation() had a boolean logic flaw where the null check was embedded inside the contents check as `(annota && annota->contents().isEmpty())`. When annota is null, this subexpression short-circuits to false, and `!m_annotations.contains(annota)` also evaluates to false when the list contains the null pointer. This causes the null pointer to bypass the guard and be dereferenced at `annota->boundary()`. Fix by reordering the condition to check `!annota` first, short-circuiting all null pointers before any dereference. Fixes: #205 --- reader/browser/BrowserPage.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reader/browser/BrowserPage.cpp b/reader/browser/BrowserPage.cpp index cf0a37c4f..708c39bc3 100644 --- a/reader/browser/BrowserPage.cpp +++ b/reader/browser/BrowserPage.cpp @@ -1031,7 +1031,7 @@ bool BrowserPage::removeAllAnnotation() for (int index = 0; index < m_annotations.size(); index++) { deepin_reader::Annotation *annota = m_annotations.at(index); - if (!m_annotations.contains(annota) || (annota && annota->contents().isEmpty())) + if (!annota || !m_annotations.contains(annota) || annota->contents().isEmpty()) continue; annoBoundaries << annota->boundary();