From 204b6c99089bcf7893be326e7d0076402b7abf0c Mon Sep 17 00:00:00 2001 From: Volker Hilsheimer Date: Fri, 8 May 2020 15:29:42 +0200 Subject: [PATCH] Fix out-of-bounds access when searching arrays MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported by Coverity. All arrays in this code have the size Num... - 1, so accessing the entry at Num... - 1 is out of bounds. Since we don't dereference the value, and only use the address of the entry "one past the last" like an end- iterator, this does not actually access out-of-bounds memory. However, this code does rely on undefined behavior. Use pointer arithmetics instead to get the address of the entry "one past the last", which is well defined behavior and should satisfy Coverity. Change-Id: Ie5fbb2da080d6118169f35056763b5d95cfeda62 Fixes: QTBUG-83817 Coverity-Id: 183557 Pick-to: 5.15 Reviewed-by: Mårten Nordheim Reviewed-by: Andrei Golubev --- src/gui/text/qcssparser.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/text/qcssparser.cpp b/src/gui/text/qcssparser.cpp index 53d399a4bf..50c13d41f6 100644 --- a/src/gui/text/qcssparser.cpp +++ b/src/gui/text/qcssparser.cpp @@ -362,7 +362,7 @@ static bool operator<(const QCssKnownValue &prop, const QString &name) static quint64 findKnownValue(const QString &name, const QCssKnownValue *start, int numValues) { - const QCssKnownValue *end = &start[numValues - 1]; + const QCssKnownValue *end = start + numValues - 1; const QCssKnownValue *prop = std::lower_bound(start, end, name); if ((prop == end) || (name < *prop)) return 0;