QSettings: fix UB (signed integer overflow) on parsing long hex/oct escapes

The code did not limit the length of hex and octal escape sequences,
but used an int as the accumulator, which causes UB on overflow.

Due to the use of the QChar(int) constructor when appending escapeVal,
only the lowest 16 bit of the value were appended to the result
string. An test case encoding this behavior explicitly suggests this
is intended behavior.

It therefore suffices to use an unsigned 16-bit value as the
accumulator (unsigned, because that doesn't cause UB on overflow, 16
bits, because that's all we care for).

For future-proofing, use char16_t as the accumulator.

Pick-to: 5.15
Change-Id: I07e7ebf1f312276b2bbcb08e4360c66a3b9522ca
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

1 files changed, 5 insertions, 5 deletions

diff --git a/src/corelib/io/qsettings.cpp b/src/corelib/io/qsettings.cpp
index c9122e5962..2eeed3f57c 100644
--- a/src/corelib/io/qsettings.cpp
+++ b/src/corelib/io/qsettings.cpp
@@ -748,7 +748,7 @@ bool QSettingsPrivate::iniUnescapedStringList(const QByteArray &str, int from, i
     bool isStringList = false;
     bool inQuotedString = false;
     bool currentValueIsQuoted = false;
-    int escapeVal = 0;
+    char16_t escapeVal = 0;
     int i = from;
     char ch;
 
@@ -854,7 +854,7 @@ StNormal:
 
 StHexEscape:
     if (i >= to) {
-        stringResult += QChar(escapeVal);
+        stringResult += escapeVal;
         goto end;
     }
 
@@ -867,13 +867,13 @@ StHexEscape:
         ++i;
         goto StHexEscape;
     } else {
-        stringResult += QChar(escapeVal);
+        stringResult += escapeVal;
         goto StNormal;
     }
 
 StOctEscape:
     if (i >= to) {
-        stringResult += QChar(escapeVal);
+        stringResult += escapeVal;
         goto end;
     }
 
@@ -884,7 +884,7 @@ StOctEscape:
         ++i;
         goto StOctEscape;
     } else {
-        stringResult += QChar(escapeVal);
+        stringResult += escapeVal;
         goto StNormal;
     }