From c31fecd27fa1ca0bebc96d39ca01ff86578f8d7f Mon Sep 17 00:00:00 2001 From: Marc Mutz Date: Thu, 16 Dec 2021 10:00:47 +0100 Subject: [PATCH] QByteArray: fix UB (precondition violation) in replace() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If after.isNull(), then we called memcpy with a nullptr, which is UB, even if the size is zero, too. memmove() has the same precondition. Fix by guarding the memcpy() call with an explicit length check. The Qt 5.15 code is sufficiently different to not attempt to pick there. Pick-to: 6.3 6.2 Change-Id: I86a2f00ede6ca8fab8d4222f84dccf375c4a2194 Reviewed-by: Fabian Kosmale Reviewed-by: Mårten Nordheim --- src/corelib/text/qbytearray.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/corelib/text/qbytearray.cpp b/src/corelib/text/qbytearray.cpp index 7562548bad..a03462561f 100644 --- a/src/corelib/text/qbytearray.cpp +++ b/src/corelib/text/qbytearray.cpp @@ -2169,8 +2169,10 @@ QByteArray &QByteArray::replace(qsizetype pos, qsizetype len, QByteArrayView aft return replace(pos, len, QByteArrayView{copy}); } if (len == after.size() && (pos + len <= size())) { + // same size: in-place replacement possible detach(); - memcpy(d.data() + pos, after.data(), len*sizeof(char)); + if (len > 0) + memcpy(d.data() + pos, after.data(), len*sizeof(char)); return *this; } else { // ### optimize me