From 87c6e340a9cd64b0cfd2c77a68bf4fec84d3dd1a Mon Sep 17 00:00:00 2001
From: Marc Mutz <marc.mutz@qt.io>
Date: Sun, 20 Feb 2022 16:51:21 +0100
Subject: [PATCH] QStringConverter: fix move special member functions of State
 class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By copying 'd' instead of the (larger, on 32-bit platforms),
state_data variadic member, we may corrupt the state (by copying only
half the state).

Fix by copying state_data instead, which is guaranteed to be the
larger of the two.

The move-assignment operator must be self-assignment-safe in the
moved-from state (Hinnant Criterion), so we need to use memmove(), not
memcpy().

[ChangeLog][QtCore][QStringEncoder/Decoder] Fixed a potential data
corruption in the move constructor and move-assignment operator on
32-bit platforms.

Pick-to: 6.3 6.2
Change-Id: I7bbc475a6eecec618a011b23814cada35ce61d10
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/corelib/text/qstringconverter_base.h | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/corelib/text/qstringconverter_base.h b/src/corelib/text/qstringconverter_base.h
index f726d95b82..dd84cf8744 100644
--- a/src/corelib/text/qstringconverter_base.h
+++ b/src/corelib/text/qstringconverter_base.h
@@ -50,6 +50,8 @@
 #include <QtCore/qglobal.h> // QT_{BEGIN,END}_NAMESPACE
 #include <QtCore/qflags.h> // Q_DECLARE_FLAGS
 
+#include <cstring>
+
 QT_BEGIN_NAMESPACE
 
 class QByteArrayView;
@@ -77,7 +79,8 @@ public:
             : flags(other.flags),
               remainingChars(other.remainingChars),
               invalidChars(other.invalidChars),
-              d{other.d[0], other.d[1]},
+              state_data{other.state_data[0], other.state_data[1],
+                         other.state_data[2], other.state_data[3]},
               clearFn(other.clearFn)
         { other.clearFn = nullptr; }
         State &operator=(State &&other) noexcept
@@ -86,8 +89,7 @@ public:
             flags = other.flags;
             remainingChars = other.remainingChars;
             invalidChars = other.invalidChars;
-            d[0] = other.d[0];
-            d[1] = other.d[1];
+            std::memmove(state_data, other.state_data, sizeof state_data); // self-assignment-safe
             clearFn = other.clearFn;
             other.clearFn = nullptr;
             return *this;