whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a use-after-free problem in QByteArray::replace 

if the string pointed to by after is part of the QByteArray, we
were trying to protect against a use-after-free by copying
after. Unfortunately, it was not used later on in the code instead
of the original after.

Change-Id: I2f2263e4bb1855e802bba2fc08db34762c66887a
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
bb10
Lars Knoll 2019-11-14 12:21:04 +01:00
parent 551c665b7d
commit cde2fde3f0
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/corelib/text/qbytearray.cpp
View File

@ -2351,7 +2351,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after
if (bsize == asize) {
if (bsize) {
while ((index = matcher.indexIn(*this, index)) != -1) {
memcpy(d + index, after, asize);
memcpy(d + index, a, asize);
index += bsize;
}
}
@ -2370,7 +2370,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after
to = index;
}
if (asize) {
memcpy(d + to, after, asize);
memcpy(d + to, a, asize);
to += asize;
}
index += bsize;
@ -2422,7 +2422,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after
int moveto = insertstart + asize;
memmove(d + moveto, d + movestart, (moveend - movestart));
if (asize)
memcpy(d + insertstart, after, asize);
memcpy(d + insertstart, a, asize);
moveend = movestart - bsize;
}
}