From f226854d256a382a5cc7ff08b10a0d27fbefb0fe Mon Sep 17 00:00:00 2001
From: Andrei Golubev <andrei.golubev@qt.io>
Date: Thu, 11 Mar 2021 10:01:04 +0100
Subject: [PATCH] Fix QMultiHash::count(key) crash

As QMultiHash uses a pointer for the data, nullptr dereference is a
thing, so check for valid d before doing anything in count()

Fixes: QTBUG-91704
Pick-to: 6.0 6.1
Change-Id: Ia20440cd7bdc03cb09c77f796fb9c5b52765eac5
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/corelib/tools/qhash.h                    |  4 ++++
 tests/auto/corelib/tools/qhash/tst_qhash.cpp | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/src/corelib/tools/qhash.h b/src/corelib/tools/qhash.h
index b3c389903a3..4fb68ba0b56 100644
--- a/src/corelib/tools/qhash.h
+++ b/src/corelib/tools/qhash.h
@@ -1806,6 +1806,8 @@ public:
 
     qsizetype count(const Key &key) const noexcept
     {
+        if (!d)
+            return 0;
         auto it = d->find(key);
         if (it.isUnused())
             return 0;
@@ -1821,6 +1823,8 @@ public:
 
     qsizetype count(const Key &key, const T &value) const noexcept
     {
+        if (!d)
+            return 0;
         auto it = d->find(key);
         if (it.isUnused())
             return 0;
diff --git a/tests/auto/corelib/tools/qhash/tst_qhash.cpp b/tests/auto/corelib/tools/qhash/tst_qhash.cpp
index 014617f8d49..079b9c6ab7e 100644
--- a/tests/auto/corelib/tools/qhash/tst_qhash.cpp
+++ b/tests/auto/corelib/tools/qhash/tst_qhash.cpp
@@ -80,6 +80,8 @@ private slots:
     void hashOfHash();
 
     void stdHash();
+
+    void countInEmptyHash();
 };
 
 struct IdentityTracker {
@@ -1976,5 +1978,18 @@ void tst_QHash::stdHash()
     QVERIFY(!strings.contains("z"));
 }
 
+void tst_QHash::countInEmptyHash()
+{
+    {
+        QHash<int, int> hash;
+        QCOMPARE(hash.count(42), 0);
+    }
+
+    {
+        QMultiHash<int, int> hash;
+        QCOMPARE(hash.count(42), 0);
+    }
+}
+
 QTEST_APPLESS_MAIN(tst_QHash)
 #include "tst_qhash.moc"