From cde2fde3f0ee1551b4907b3d8b82f0be5f20af25 Mon Sep 17 00:00:00 2001 From: Lars Knoll Date: Thu, 14 Nov 2019 12:21:04 +0100 Subject: [PATCH] Fix a use-after-free problem in QByteArray::replace if the string pointed to by after is part of the QByteArray, we were trying to protect against a use-after-free by copying after. Unfortunately, it was not used later on in the code instead of the original after. Change-Id: I2f2263e4bb1855e802bba2fc08db34762c66887a Reviewed-by: Simon Hausmann --- src/corelib/text/qbytearray.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/corelib/text/qbytearray.cpp b/src/corelib/text/qbytearray.cpp index fa328a6d26..d7fcfce90c 100644 --- a/src/corelib/text/qbytearray.cpp +++ b/src/corelib/text/qbytearray.cpp @@ -2351,7 +2351,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after if (bsize == asize) { if (bsize) { while ((index = matcher.indexIn(*this, index)) != -1) { - memcpy(d + index, after, asize); + memcpy(d + index, a, asize); index += bsize; } } @@ -2370,7 +2370,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after to = index; } if (asize) { - memcpy(d + to, after, asize); + memcpy(d + to, a, asize); to += asize; } index += bsize; @@ -2422,7 +2422,7 @@ QByteArray &QByteArray::replace(const char *before, int bsize, const char *after int moveto = insertstart + asize; memmove(d + moveto, d + movestart, (moveend - movestart)); if (asize) - memcpy(d + insertstart, after, asize); + memcpy(d + insertstart, a, asize); moveend = movestart - bsize; } }