whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix handling of bad compose table 

The ASAN talk at QtCon was pointing out a out of
bound read in a vector.
Let's try to do something about it.

If the lazy initialization of compose table fails,
the first character handling still tries to actually
access it. Later characters are properly handled
in the caller.

Reported-by: Hanno Böck
Change-Id: Ieac3e95361abd0fcd06c555bcd00ca1c4d8f1931
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
bb10
Sune Vuorela 2016-09-04 14:59:37 +02:00
parent c59c759fcc
commit 469d68b344
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/plugins/platforminputcontexts/compose/qcomposeplatforminputcontext.cpp
View File

@ -162,11 +162,19 @@ bool QComposeInputContext::checkComposeTable()
TableGenerator reader;
m_tableState = reader.tableState();
if ((m_tableState & TableGenerator::NoErrors) == TableGenerator::NoErrors)
m_composeTable = reader.composeTable();
m_compositionTableInitialized = true;
if ((m_tableState & TableGenerator::NoErrors) == TableGenerator::NoErrors) {
m_composeTable = reader.composeTable();
} else {
#ifdef DEBUG_COMPOSING
qDebug( "### FAILED_PARSING ###" );
#endif
// if we have errors, don' try to look things up anyways.
reset();
return false;
}
}
Q_ASSERT(!m_composeTable.isEmpty());
QVector<QComposeTableElement>::const_iterator it =
std::lower_bound(m_composeTable.constBegin(), m_composeTable.constEnd(), m_composeBuffer, Compare());