From fc0191a5127e939758ef405aa7a5b4e03d60f67a Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Sun, 8 Oct 2023 16:17:22 +0200
Subject: [PATCH] Disable Public key import when displaying key of cert

Importing the displayed public key of a certificate during
certificate import resulted in a double free.

The "import" flag of the key-details can now forcefully
disable the import button.

Fixing it was way more complex than simply disabling it.

Also add sanity checks for pointers that are not our childs
when creating the QModelIndex
---
 lib/db_base.cpp         |  2 +-
 lib/db_x509.cpp         |  2 ++
 lib/pki_base.cpp        |  3 +--
 widgets/CertDetail.cpp  |  2 +-
 widgets/ImportMulti.cpp |  5 +++--
 widgets/KeyDetail.cpp   | 10 ++++++----
 widgets/KeyDetail.h     |  4 ++--
 7 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/lib/db_base.cpp b/lib/db_base.cpp
index bb6f3fc8..4d7cc87d 100644
--- a/lib/db_base.cpp
+++ b/lib/db_base.cpp
@@ -400,7 +400,7 @@ QModelIndex db_base::index(int row, int column,
 
 QModelIndex db_base::index(pki_base *pki) const
 {
-	if (!pki || pki == treeItem)
+	if (!pki || pki == treeItem || rootItem->indexOf(pki) == -1)
 		return QModelIndex();
 	return createIndex(rownumber(pki), 0, pki);
 }
diff --git a/lib/db_x509.cpp b/lib/db_x509.cpp
index 0c873e5a..6c997e35 100644
--- a/lib/db_x509.cpp
+++ b/lib/db_x509.cpp
@@ -112,6 +112,8 @@ QList<pki_x509 *> db_x509::getAllIssuers()
 
 void db_x509::remFromCont(const QModelIndex &idx)
 {
+	if (!idx.isValid())
+		return;
 	db_crl *crls = Database.model<db_crl>();
 	db_x509super::remFromCont(idx);
 	pki_base *pki = fromIndex(idx);
diff --git a/lib/pki_base.cpp b/lib/pki_base.cpp
index 30fded95..62ca3ac5 100644
--- a/lib/pki_base.cpp
+++ b/lib/pki_base.cpp
@@ -252,8 +252,7 @@ int pki_base::childCount() const
 
 int pki_base::indexOf(const pki_base *child) const
 {
-	int ret = childItems.indexOf(const_cast<pki_base *>(child));
-	return ret >= 0 ? ret : 0;
+	return childItems.indexOf(const_cast<pki_base *>(child));
 }
 
 void pki_base::takeChild(pki_base *pki)
diff --git a/widgets/CertDetail.cpp b/widgets/CertDetail.cpp
index 5e30239a..42d7a34f 100644
--- a/widgets/CertDetail.cpp
+++ b/widgets/CertDetail.cpp
@@ -269,7 +269,7 @@ void CertDetail::itemChanged(pki_base *pki)
 
 void CertDetail::showPubKey()
 {
-	KeyDetail::showKey(this, myPubKey, !keySqlId.isValid());
+	KeyDetail::showKey(this, myPubKey, false);
 }
 
 void CertDetail::showIssuer()
diff --git a/widgets/ImportMulti.cpp b/widgets/ImportMulti.cpp
index f345ab0a..7e01a7ff 100644
--- a/widgets/ImportMulti.cpp
+++ b/widgets/ImportMulti.cpp
@@ -237,11 +237,12 @@ pki_base *ImportMulti::import(const QModelIndex &idx)
 
 pki_base *ImportMulti::import(pki_base *pki)
 {
-	QModelIndex idx = mcont->index(pki);
 	if (!pki || pki->getSqlItemId().isValid())
 		return NULL;
 
-	mcont->remFromCont(idx);
+	QModelIndex idx = mcont->index(pki);
+	if (idx.isValid())
+		mcont->remFromCont(idx);
 
 	if (!Database.isOpen()) {
 		try {
diff --git a/widgets/KeyDetail.cpp b/widgets/KeyDetail.cpp
index bab75736..1d7030b7 100644
--- a/widgets/KeyDetail.cpp
+++ b/widgets/KeyDetail.cpp
@@ -72,12 +72,13 @@ void KeyDetail::setupFingerprints(pki_key *key)
 	}
 }
 
-void KeyDetail::setKey(pki_key *key)
+void KeyDetail::setKey(pki_key *key, bool import)
 {
 	keySqlId = key->getSqlItemId();
 	descr->setText(key->getIntName());
 	keyLength->setText(key->length());
-	connect_pki(key);
+	if (import)
+		connect_pki(key);
 
 	keyPrivEx->disableToolTip();
 	if (!key->isToken())
@@ -151,12 +152,13 @@ void KeyDetail::itemChanged(pki_base *pki)
 		descr->setText(pki->getIntName());
 }
 
-void KeyDetail::showKey(QWidget *parent, pki_key *key, bool ro)
+void KeyDetail::showKey(QWidget *parent, pki_key *key, bool import)
 {
 	if (!key)
 		return;
 	KeyDetail *dlg = new KeyDetail(parent);
-	dlg->setKey(key);
+	bool ro = !key->getSqlItemId().isValid();
+	dlg->setKey(key, import);
 	dlg->descr->setReadOnly(ro);
 	dlg->comment->setReadOnly(ro);
 
diff --git a/widgets/KeyDetail.h b/widgets/KeyDetail.h
index 4d956677..0e7e060a 100644
--- a/widgets/KeyDetail.h
+++ b/widgets/KeyDetail.h
@@ -22,9 +22,9 @@ class KeyDetail: public XcaDetail, public Ui::KeyDetail
 
   public:
 	KeyDetail(QWidget *w = nullptr);
-	void setKey(pki_key *key);
+	void setKey(pki_key *key, bool import = true);
 	void setupFingerprints(pki_key *key);
-	static void showKey(QWidget *parent, pki_key *keyi, bool ro = false);
+	static void showKey(QWidget *parent, pki_key *key, bool import = true);
 
   public slots:
 	void itemChanged(pki_base *pki) override;