From bbd1f576f70fb52187185b79636e6591cd17e9b5 Mon Sep 17 00:00:00 2001 From: Marc Mutz Date: Mon, 19 Sep 2022 17:05:53 +0200 Subject: [PATCH] qUn/Compress: reject negative lengths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In qCompress, we've been calculating postive len values out of them, only to fail at random points later, possibly running into UB. Fail early instead. In qUncompress, we've been catching negative values, and reported them indiscriminately as "invalid data". Use a better warning message instead. By rights, nbytes ≥ 0 would be a precondition of both functions (which we would Q_ASSERT() on), but seeing we're picking this back into LTS branches, I found it prudent to use a non-fatal way to signal the precondition violation. If and when we keep these functions for Qt 7, it will be as an overload that takes QByteArrayView, in which case nbytes ≥ 0 enters as a hard precondition via the QByteArrayView constructor, so there appears to be no need to pre-program a Q_ASSERT() for Qt 7.0. Pick-to: 6.4 6.3 6.2 Task-number: QTBUG-104972 Task-number: QTBUG-106542 Change-Id: I6a1b25fe12d31e3d4c845033cad320832976f83c Reviewed-by: Edward Welbourne Reviewed-by: Thiago Macieira Reviewed-by: Mårten Nordheim --- src/corelib/text/qbytearray.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/corelib/text/qbytearray.cpp b/src/corelib/text/qbytearray.cpp index 8151588234..6ae0237d55 100644 --- a/src/corelib/text/qbytearray.cpp +++ b/src/corelib/text/qbytearray.cpp @@ -558,6 +558,12 @@ static QByteArray dataIsNull(ZLibOp op) return zlibError(op, "Data is null"); } +Q_DECL_COLD_FUNCTION +static QByteArray lengthIsNegative(ZLibOp op) +{ + return zlibError(op, "Input length is negative"); +} + Q_DECL_COLD_FUNCTION static QByteArray tooMuchData(ZLibOp op) { @@ -579,6 +585,9 @@ QByteArray qCompress(const uchar* data, qsizetype nbytes, int compressionLevel) if (!data) return dataIsNull(ZLibOp::Compression); + if (nbytes < 0) + return lengthIsNegative(ZLibOp::Compression); + if (compressionLevel < -1 || compressionLevel > 9) compressionLevel = -1; @@ -657,6 +666,9 @@ QByteArray qUncompress(const uchar* data, qsizetype nbytes) if (!data) return dataIsNull(ZLibOp::Decompression); + if (nbytes < 0) + return lengthIsNegative(ZLibOp::Decompression); + constexpr qsizetype HeaderSize = sizeof(CompressSizeHint_t); if (nbytes < HeaderSize) return invalidCompressedData();