whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix crash when reading window titles with XCB 

This is a regression introduced with commit
cb142954c5 that changed the code from
using QString:fromUtf8(name, propertyLength) to QString::fromUtf8(name),
assuming that the property name is a zero-terminated string. That
however is not correct.

ASAN trace:

==4039==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400001e0b4 at pc 0x7f3383c7d66e bp 0x7ffdc8e3d9b0 sp 0x7ffdc8e3d158
READ of size 5 at 0x60400001e0b4 thread T0
    #0 0x7f3383c7d66d  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x5166d)
    #1 0x7f337602f32a in QString::fromUtf8(char const*, int) ../../../../include/QtCore/../../src/corelib/tools/qstring.h:569
    #2 0x7f337602f32a in QXcbWindow::windowTitle(QXcbConnection const*, unsigned int) /home/simon/dev/qt-5.11/qtbase/src/plugins/platforms/xcb/qxcbwindow.cpp:2861
[...]

0x60400001e0b4 is located 0 bytes to the right of 36-byte region [0x60400001e090,0x60400001e0b4)
allocated by thread T1 (QXcbEventReader) here:
    #0 0x7f3383d0ab50 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xdeb50)
    #1 0x7f337b397e2b  (/usr/lib/x86_64-linux-gnu/libxcb.so.1+0xde2b)

Change-Id: Ia5024602d3aacb924b5dcd3956672da2a8f10feb
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
bb10
Simon Hausmann 2018-02-15 11:02:07 +01:00
parent b59181c42d
commit 2a80c04d3b
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/plugins/platforms/xcb/qxcbwindow.cpp
View File

@ -2857,7 +2857,7 @@ QString QXcbWindow::windowTitle(const QXcbConnection *conn, xcb_window_t window)
utf8Atom, 0, 1024);
if (reply && reply->format == 8 && reply->type == utf8Atom) {
const char *name = reinterpret_cast<const char *>(xcb_get_property_value(reply.get()));
return QString::fromUtf8(name);
return QString::fromUtf8(name, xcb_get_property_value_length(reply.get()));
}
return QString();
}