whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QUuid:: fix UB in (Id128Bytes) ctor 

After qbswap() has run, the Id128Bytes active member is data64, yet
the rest of the QUuid constructor accesses .data. This is UB.

Use the void* dest overload of qbswap() or memcpy() the Id128Bytes
into a char buffer and consume data from there instead.

Amends 686c02224c.

Task-number: QTBUG-120637
Pick-to: 6.7 6.6 6.5
Change-Id: Iba62a692391a5600b867c30dcb3bc50b82ee072f
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit f5b7e8a3fbc27082651b8eda08f1fe4ff7d70f3f)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
bb10
Marc Mutz 2024-01-08 15:31:48 +01:00 committed by Qt Cherry-pick Bot
parent 68326ad432
commit 2f8d5ea487
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/corelib/plugin/quuid.h
View File

@ -283,12 +283,15 @@ Q_CORE_EXPORT size_t qHash(const QUuid &uuid, size_t seed = 0) noexcept;
QUuid::QUuid(Id128Bytes uuid, QSysInfo::Endian order) noexcept
{
char bytes[sizeof uuid];
if (order == QSysInfo::LittleEndian)
uuid = qbswap(uuid);
data1 = qFromBigEndian<quint32>(&uuid.data[0]);
data2 = qFromBigEndian<quint16>(&uuid.data[4]);
data3 = qFromBigEndian<quint16>(&uuid.data[6]);
memcpy(data4, &uuid.data[8], sizeof(data4));
qbswap(uuid, bytes);
else
memcpy(bytes, &uuid, sizeof bytes);
data1 = qFromBigEndian<quint32>(&bytes[0]);
data2 = qFromBigEndian<quint16>(&bytes[4]);
data3 = qFromBigEndian<quint16>(&bytes[6]);
memcpy(data4, &bytes[8], sizeof(data4));
}
QUuid::Id128Bytes QUuid::toBytes(QSysInfo::Endian order) const noexcept