diff options
author | Marc Mutz <marc.mutz@qt.io> | 2024-01-27 09:17:57 +0100 |
---|---|---|
committer | Marc Mutz <marc.mutz@qt.io> | 2024-01-31 21:18:47 +0100 |
commit | 0808beace332631f8100b5700577f10f63e4630c (patch) | |
tree | 93accea50f363e25f77c8cc74922c977c4aafeb8 /src/corelib/tools/qbitarray.cpp | |
parent | 40a87ca1b421457fc2a31cf385eb5a0eda83486f (diff) |
QBitArray: fix potential truncation in QDataStream op>>()
In Qt 5, a QBitArray could not contain more than INT_MAX bits, because
the then-size_type, int, cannot represent more, even if the underlying
storage could hold 8x as much, and the serialisation format, using
unsigned int, could represent 2x.
Therefore, reject old formats with sizes that exceed INT_MAX elements
as corrupt.
Likewise, the Qt 6 serialisation format unconditionally uses 64-bit
sizes, but 32-bit platforms still cannot represent more than
numeric_limits<qsizetype>::max() (= INT_MAX) bits in memory. This is a
valid stream for 64-bit platforms, though, so ideally, this should be
using SizeLimitsExeeded, which, however, is only available from Qt
6.7. So, for now, and until we have SizeLimitsExeeded, mark the stream
as corrupt here, too.
[ChangeLog][QtCore][QBitArray] Fixed undetected overflows in the
deserialisation (opertor>>()) from QDataStream.
Pick-to: 6.7 6.6 6.5 6.2 5.15
Change-Id: Ib24cf9218c06a3a05185723c77d4313611c2dd40
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'src/corelib/tools/qbitarray.cpp')
-rw-r--r-- | src/corelib/tools/qbitarray.cpp | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/corelib/tools/qbitarray.cpp b/src/corelib/tools/qbitarray.cpp index cc3b8a15cf..ef30b97a6c 100644 --- a/src/corelib/tools/qbitarray.cpp +++ b/src/corelib/tools/qbitarray.cpp @@ -7,6 +7,9 @@ #include <qdatastream.h> #include <qdebug.h> #include <qendian.h> + +#include <limits> + #include <string.h> QT_BEGIN_NAMESPACE @@ -921,10 +924,18 @@ QDataStream &operator>>(QDataStream &in, QBitArray &ba) if (in.version() < QDataStream::Qt_6_0) { quint32 tmp; in >> tmp; + if (Q_UNLIKELY(tmp > quint32((std::numeric_limits<qint32>::max)()))) { + in.setStatus(QDataStream::ReadCorruptData); + return in; + } len = tmp; } else { quint64 tmp; in >> tmp; + if (Q_UNLIKELY(tmp > quint64((std::numeric_limits<qsizetype>::max)()))) { + in.setStatus(QDataStream::ReadCorruptData); // ### SizeLimitExeeded + return in; + } len = tmp; } if (len == 0) { |