diff options
| author | Marc Mutz <marc.mutz@qt.io> | 2022-09-06 16:53:23 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2022-09-08 05:21:06 +0000 |
| commit | aff505ed810bd4616ae9955be050937e039e8910 (patch) | |
| tree | 59b762d9e6ea2263f239a034266d0f7c03937208 | |
| parent | 07a4969a92fe1718623e7b3fb4171972a6c3768b (diff) | |
qUncompress: statically assert that arithmetic overflow cannot occur
... because the limit we check against, doubled, is still within the
range of size_t.
Took me a while to prove this to myself, so document the finding in a
static assertion.
Change-Id: Ib2d1bb825c1693ccc4ffa1d8fc0bd455a170337f
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit c97bcaaa1aa95570bd4911294bc8a0cb557b168d)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/corelib/text/qbytearray.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/corelib/text/qbytearray.cpp b/src/corelib/text/qbytearray.cpp index 256b7288c2..d791235e05 100644 --- a/src/corelib/text/qbytearray.cpp +++ b/src/corelib/text/qbytearray.cpp @@ -667,7 +667,7 @@ QByteArray qUncompress(const uchar* data, qsizetype nbytes) size_t expectedSize = size_t((data[0] << 24) | (data[1] << 16) | (data[2] << 8) | (data[3] )); size_t len = qMax(expectedSize, 1ul); - const size_t maxPossibleSize = MaxAllocSize - sizeof(QByteArray::Data); + constexpr size_t maxPossibleSize = MaxAllocSize - sizeof(QByteArray::Data); if (Q_UNLIKELY(len >= maxPossibleSize)) { // QByteArray does not support that huge size anyway. return invalidCompressedData(); @@ -696,6 +696,8 @@ QByteArray qUncompress(const uchar* data, qsizetype nbytes) return QByteArray(); case Z_BUF_ERROR: + static_assert(maxPossibleSize <= (std::numeric_limits<decltype(len)>::max)() / 2, + "oops, next line may overflow"); len *= 2; if (Q_UNLIKELY(len >= maxPossibleSize)) { // QByteArray does not support that huge size anyway. |