QCborArray: allow large but in-range keys

The 0x10000 limit should not apply if the key is a valid index in the
array.

Change-Id: I5e52dc5b093c43a3b678fffd16b6a2a5a69acd61
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>

1 files changed, 17 insertions, 2 deletions

diff --git a/src/corelib/serialization/qcborvalue.cpp b/src/corelib/serialization/qcborvalue.cpp
index 8edcbfec1c..c0f8a9a40d 100644
--- a/src/corelib/serialization/qcborvalue.cpp
+++ b/src/corelib/serialization/qcborvalue.cpp
@@ -2215,6 +2215,21 @@ const QCborValue QCborValue::operator[](qint64 key) const
     return QCborValue();
 }
 
+static bool shouldArrayRemainArray(qint64 key, QCborValue::Type t, QCborContainerPrivate *container)
+{
+    constexpr qint64 LargeKey = 0x10000;
+    if (t != QCborValue::Array)
+        return false;
+    if (key < 0)
+        return false;           // negative keys can't be an array index
+    if (key < LargeKey)
+        return true;
+
+    // Only convert to map if key is greater than array size + 1
+    qsizetype currentSize = container ? container->elements.size() : 0;
+    return key <= currentSize;
+}
+
 /*!
   \internal
  */
@@ -2369,7 +2384,7 @@ QCborValueRef QCborValue::operator[](QLatin1String key)
  */
 QCborValueRef QCborValue::operator[](qint64 key)
 {
-    if (isArray() && key >= 0 && key < 0x10000) {
+    if (shouldArrayRemainArray(key, t, container)) {
         container = maybeGrow(container, key);
         return { container, qsizetype(key) };
     }
@@ -2898,7 +2913,7 @@ QCborValueRef QCborValueRef::operator[](QLatin1String key)
 QCborValueRef QCborValueRef::operator[](qint64 key)
 {
     auto &e = d->elements[i];
-    if (e.type == QCborValue::Array && key >= 0 && key < 0x10000) {
+    if (shouldArrayRemainArray(key, e.type, e.container)) {
         e.container = maybeGrow(e.container, key);
         e.flags |= QtCbor::Element::IsContainer;
         return { e.container, qsizetype(key) };