diff options
| author | Liang Qi <liang.qi@qt.io> | 2016-11-17 14:15:53 +0100 |
|---|---|---|
| committer | Liang Qi <liang.qi@qt.io> | 2016-11-17 14:43:26 +0100 |
| commit | e5ac4afbf954a3e1616ce8543d46ddc668d0374f (patch) | |
| tree | be6d97001edebd5cb74c64aaf0010f3cc76a7293 /src/corelib/json/qjson.cpp | |
| parent | e3ed95dd44b95b6e9361b562807e711d7ce5a58b (diff) | |
| parent | 03c1a6ac717e3c5693653a5e294214056bda970e (diff) | |
Merge remote-tracking branch 'origin/5.8' into dev
Conflicts:
mkspecs/features/mac/default_post.prf
mkspecs/features/uikit/default_post.prf
Change-Id: I2a6f783451f2ac9eb4c1a050f605435d2dacf218
Diffstat (limited to 'src/corelib/json/qjson.cpp')
| -rw-r--r-- | src/corelib/json/qjson.cpp | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/src/corelib/json/qjson.cpp b/src/corelib/json/qjson.cpp index e9a1366af0..d509349a51 100644 --- a/src/corelib/json/qjson.cpp +++ b/src/corelib/json/qjson.cpp @@ -135,10 +135,12 @@ bool Data::valid() const return false; bool res = false; - if (header->root()->is_object) - res = static_cast<Object *>(header->root())->isValid(); + Base *root = header->root(); + int maxSize = alloc - sizeof(Header); + if (root->is_object) + res = static_cast<Object *>(root)->isValid(maxSize); else - res = static_cast<Array *>(header->root())->isValid(); + res = static_cast<Array *>(root)->isValid(maxSize); return res; } @@ -223,9 +225,9 @@ int Object::indexOf(QLatin1String key, bool *exists) const return min; } -bool Object::isValid() const +bool Object::isValid(int maxSize) const { - if (tableOffset + length*sizeof(offset) > size) + if (size > (uint)maxSize || tableOffset + length*sizeof(offset) > size) return false; QString lastKey; @@ -234,8 +236,7 @@ bool Object::isValid() const if (entryOffset + sizeof(Entry) >= tableOffset) return false; Entry *e = entryAt(i); - int s = e->size(); - if (table()[i] + s > tableOffset) + if (!e->isValid(tableOffset - table()[i])) return false; QString key = e->key(); if (key < lastKey) @@ -249,9 +250,9 @@ bool Object::isValid() const -bool Array::isValid() const +bool Array::isValid(int maxSize) const { - if (tableOffset + length*sizeof(offset) > size) + if (size > (uint)maxSize || tableOffset + length*sizeof(offset) > size) return false; for (uint i = 0; i < length; ++i) { @@ -359,12 +360,12 @@ bool Value::isValid(const Base *b) const int s = usedStorage(b); if (!s) return true; - if (s < 0 || offset + s > (int)b->tableOffset) + if (s < 0 || s > (int)b->tableOffset - offset) return false; if (type == QJsonValue::Array) - return static_cast<Array *>(base(b))->isValid(); + return static_cast<Array *>(base(b))->isValid(s); if (type == QJsonValue::Object) - return static_cast<Object *>(base(b))->isValid(); + return static_cast<Object *>(base(b))->isValid(s); return true; } |