diff options
| author | Peter Hartmann <peter.hartmann@nokia.com> | 2010-04-23 16:12:10 +0200 |
|---|---|---|
| committer | Peter Hartmann <peter.hartmann@nokia.com> | 2010-04-27 15:27:10 +0200 |
| commit | 0948393df9b9046db5c3c92a12698aee056d8483 (patch) | |
| tree | b1a8dba2cd9c4d5aaa3971369694ef6486c1495d /src/corelib/xml | |
| parent | daf16a0f6e495aed4e8b68bd4b3fb2eff1c90969 (diff) | |
fix crash in QXmlStreamReader
this fixes a possible off-by-one data corruption which apparently is
only triggered in rare circumstances.
The problem was: We were checking whether we would need to reallocate
the stack (line 1245), but sometimes were incrementing tos (line 1278)
and then accessing the state stack at an out-of-bounds position (line
1951).
Additionally, adapt the qlalr generator for changes made to
qxmlstream_p.h directly and recreate that file with qlalr.
Reviewed-by: Frans Englich
Reviewed-by: Roberto Raggi
Task-number: QTBUG-9196
Diffstat (limited to 'src/corelib/xml')
| -rw-r--r-- | src/corelib/xml/qxmlstream.g | 2 | ||||
| -rw-r--r-- | src/corelib/xml/qxmlstream_p.h | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/src/corelib/xml/qxmlstream.g b/src/corelib/xml/qxmlstream.g index 1b882e093a..e91408f866 100644 --- a/src/corelib/xml/qxmlstream.g +++ b/src/corelib/xml/qxmlstream.g @@ -748,7 +748,7 @@ bool QXmlStreamReaderPrivate::parse() state_stack[tos] = 0; return true; } else if (act > 0) { - if (++tos == stack_size) + if (++tos == stack_size-1) reallocateStack(); Value &val = sym_stack[tos]; diff --git a/src/corelib/xml/qxmlstream_p.h b/src/corelib/xml/qxmlstream_p.h index ac421cf8b0..f6ab3a19bc 100644 --- a/src/corelib/xml/qxmlstream_p.h +++ b/src/corelib/xml/qxmlstream_p.h @@ -61,7 +61,7 @@ class QXmlStreamReader_Table { public: - enum { + enum VariousConstants { EOF_SYMBOL = 0, AMPERSAND = 5, ANY = 41, @@ -1242,7 +1242,7 @@ bool QXmlStreamReaderPrivate::parse() state_stack[tos] = 0; return true; } else if (act > 0) { - if (++tos == stack_size) + if (++tos == stack_size-1) reallocateStack(); Value &val = sym_stack[tos]; |