1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QAsn1Element: Avoid overflow in QAsn1Element::toInteger

Browse Source 
Fixes oss-fuzz issue 29534.

Change-Id: I51d0b8238c73e5860c40d3b74577ddb8926647a3
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
(cherry picked from commit 11a3eab1e168256778c45090b56e998e50c08c55)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Robert Löhning 2021-02-01 17:57:40 +01:00 committed by Qt Cherry-pick Bot
parent b668373477
commit 13c0eee15f
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/network/ssl/qasn1element.cpp
View File

@ -327,8 +327,9 @@ qint64 QAsn1Element::toInteger(bool *ok) const
return 0;
}
// NOTE: negative numbers are not handled
if (mValue.at(0) & 0x80) {
// NOTE: - negative numbers are not handled
// - greater sizes would overflow
if (mValue.at(0) & 0x80 || mValue.size() > 8) {
if (ok)
*ok = false;
return 0;