diff --git a/src/corelib/text/qbytearray.cpp b/src/corelib/text/qbytearray.cpp index 8151588234..6ae0237d55 100644 --- a/src/corelib/text/qbytearray.cpp +++ b/src/corelib/text/qbytearray.cpp @@ -558,6 +558,12 @@ static QByteArray dataIsNull(ZLibOp op) return zlibError(op, "Data is null"); } +Q_DECL_COLD_FUNCTION +static QByteArray lengthIsNegative(ZLibOp op) +{ + return zlibError(op, "Input length is negative"); +} + Q_DECL_COLD_FUNCTION static QByteArray tooMuchData(ZLibOp op) { @@ -579,6 +585,9 @@ QByteArray qCompress(const uchar* data, qsizetype nbytes, int compressionLevel) if (!data) return dataIsNull(ZLibOp::Compression); + if (nbytes < 0) + return lengthIsNegative(ZLibOp::Compression); + if (compressionLevel < -1 || compressionLevel > 9) compressionLevel = -1; @@ -657,6 +666,9 @@ QByteArray qUncompress(const uchar* data, qsizetype nbytes) if (!data) return dataIsNull(ZLibOp::Decompression); + if (nbytes < 0) + return lengthIsNegative(ZLibOp::Decompression); + constexpr qsizetype HeaderSize = sizeof(CompressSizeHint_t); if (nbytes < HeaderSize) return invalidCompressedData();