whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QMap: fix another UB (invalid cast) relating to QMap's end 

Like in commit 75cdf654bc, we use the
pointer value of the QMap header (which is of type QMapNodeBase) as a
sentinel. It's never dereferenced. In that commit, the issue was calling
end() directly; in here, it happens when iterating forward from any
element, which means nextNode() can reach back to the header.

However, using static_cast is wrong, so we use reinterpret_cast.

Change-Id: I39332e0a867442d58082fffd15040317704a87ce
Reviewed-by: Olivier Goffart (Woboq GmbH) <ogoffart@woboq.com>
bb10
Thiago Macieira 2017-12-26 23:39:33 -02:00
parent e548406d28
commit 6f7b64e2a9
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/corelib/tools/qmap.h
View File

@ -115,9 +115,9 @@ struct QMapNode : public QMapNodeBase
inline QMapNode *leftNode() const { return static_cast<QMapNode *>(left); }
inline QMapNode *rightNode() const { return static_cast<QMapNode *>(right); }
inline const QMapNode *nextNode() const { return static_cast<const QMapNode *>(QMapNodeBase::nextNode()); }
inline const QMapNode *nextNode() const { return reinterpret_cast<const QMapNode *>(QMapNodeBase::nextNode()); }
inline const QMapNode *previousNode() const { return static_cast<const QMapNode *>(QMapNodeBase::previousNode()); }
inline QMapNode *nextNode() { return static_cast<QMapNode *>(QMapNodeBase::nextNode()); }
inline QMapNode *nextNode() { return reinterpret_cast<QMapNode *>(QMapNodeBase::nextNode()); }
inline QMapNode *previousNode() { return static_cast<QMapNode *>(QMapNodeBase::previousNode()); }
QMapNode<Key, T> *copy(QMapData<Key, T> *d) const;