1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix use-after-free because QByteArray::data() was copying data

Browse Source 
Previously there was a mixture of buf.constData() and buf.data() with
buf not being const QByteArray. As a result, buf.data() returned a
re-allocated buffer and texData was keeping pointers to that one, which
became invalid once the function returned and the re-allocated buffer
was cleaned up by destructor.

Change buf to const QByteArray so that there is no difference between
data() and constData(). Additionally convert all constData() calls to
data() to avoid confusion.

Detected by Address Sanitizer on testcase
  tst_qtexturefilereader::checkMetadata()

Change-Id: Idb6f6141898678bf95ed9233a92b7bb3ad12e250
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
(cherry picked from commit b8677bd31fdb8e0cc897dcd4e39e121baa3e9722)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Dimitrios Apostolou 2022-04-09 00:06:22 +02:00 committed by Qt Cherry-pick Bot
parent a2704c3421
commit 966cb216e8
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/gui/util/qktxhandler.cpp
View File

@ -123,14 +123,14 @@ QTextureFileData QKtxHandler::read()
if (!device())
return QTextureFileData();
QByteArray buf = device()->readAll();
const QByteArray buf = device()->readAll();
const quint32 dataSize = quint32(buf.size());
if (dataSize < headerSize || !canRead(QByteArray(), buf)) {
qCDebug(lcQtGuiTextureIO, "Invalid KTX file %s", logName().constData());
return QTextureFileData();
}
const KTXHeader *header = reinterpret_cast<const KTXHeader *>(buf.constData());
const KTXHeader *header = reinterpret_cast<const KTXHeader *>(buf.data());
if (!checkHeader(*header)) {
qCDebug(lcQtGuiTextureIO, "Unsupported KTX file format in %s", logName().constData());
return QTextureFileData();
@ -159,7 +159,7 @@ QTextureFileData QKtxHandler::read()
if (offset + sizeof(quint32) > dataSize) // Corrupt file; avoid oob read
break;
const quint32 imageSize = decode(qFromUnaligned<quint32>(buf.constData() + offset));
const quint32 imageSize = decode(qFromUnaligned<quint32>(buf.data() + offset));
offset += sizeof(quint32);
for (int face = 0; face < qMin(texData.numFaces(), MAX_ITERATIONS); face++) {