1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QDataStream::readBytes: guard against integer overflow

Browse Source 
The step variable changes in the geometric progression, which means
that it may overflow at some point. Since it is a qsizetype (signed 64
or 32 bit integer), the overflow would be UB, so we need to avoid it.
Add an extra check that the step is lower than the safe threshold
before increasing it.

Amends a1bfac287ee5d3719646d68dc91dc8e8e4cec04e.

Change-Id: I6097986e614937fa88b31b3dd1e53ecff22533d7
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 2352fa0040f133e30ccc3955031618f51214791d)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Ivan Solovev 2024-04-26 17:11:04 +02:00 committed by Qt Cherry-pick Bot
parent 16365a0b65
commit 232a866ea8
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/corelib/serialization/qdatastream.cpp
View File

@ -1116,6 +1116,7 @@ QDataStream &QDataStream::readBytes(char *&s, qint64 &l)
char *prevBuf = nullptr;
char *curBuf = nullptr;
constexpr qsizetype StepIncreaseThreshold = std::numeric_limits<qsizetype>::max() / 2;
do {
qsizetype blockSize = qMin(step, len - allocated);
prevBuf = curBuf;
@ -1129,7 +1130,8 @@ QDataStream &QDataStream::readBytes(char *&s, qint64 &l)
return *this;
}
allocated += blockSize;
step *= 2;
if (step <= StepIncreaseThreshold)
step *= 2;
} while (allocated < len);
s = curBuf;