whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QDataStream::readBytes: guard against integer overflow 

The step variable changes in the geometric progression, which means
that it may overflow at some point. Since it is a qsizetype (signed 64
or 32 bit integer), the overflow would be UB, so we need to avoid it.
Add an extra check that the step is lower than the safe threshold
before increasing it.

Amends a1bfac287e.

Pick-to: 6.7
Change-Id: I6097986e614937fa88b31b3dd1e53ecff22533d7
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
bb10
Ivan Solovev 2024-04-26 17:11:04 +02:00
parent 5cdac10b46
commit 2352fa0040
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/corelib/serialization/qdatastream.cpp
View File

@ -1090,6 +1090,7 @@ QDataStream &QDataStream::readBytes(char *&s, qint64 &l)
qsizetype allocated = 0;
std::unique_ptr<char[]> curBuf = nullptr;
constexpr qsizetype StepIncreaseThreshold = std::numeric_limits<qsizetype>::max() / 2;
do {
qsizetype blockSize = qMin(step, len - allocated);
const qsizetype n = allocated + blockSize + 1;
@ -1098,7 +1099,8 @@ QDataStream &QDataStream::readBytes(char *&s, qint64 &l)
if (readBlock(curBuf.get() + allocated, blockSize) != blockSize)
return *this;
allocated += blockSize;
step *= 2;
if (step <= StepIncreaseThreshold)
step *= 2;
} while (allocated < len);
s = curBuf.release();