diff options
author | Ulf Hermann <ulf.hermann@digia.com> | 2014-09-19 14:06:11 +0200 |
---|---|---|
committer | Marc Mutz <marc.mutz@kdab.com> | 2014-10-17 09:58:56 +0200 |
commit | 9d44645eae144fcfefa0de2455d41f04d29c40d4 (patch) | |
tree | 65159e3a7722714253e13beb408e96e781c72a83 /src/corelib/tools/qvector.h | |
parent | f93870ed442df6e8acd068a19ba265ed42e70ee1 (diff) |
Do Q_CHECK_PTR on all results of QArrayData::allocate()
QArrayData::allocate() uses malloc() which can return 0. We need to
check for that when using it inside other containers. The containers
might otherwise return a seemingly valid result from some allocating
operation which is actually corrupt.
Task-number: QTBUG-41231
Change-Id: I16cc6035e4f495f519bd38bf29cee080ee0637f6
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
Diffstat (limited to 'src/corelib/tools/qvector.h')
-rw-r--r-- | src/corelib/tools/qvector.h | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/corelib/tools/qvector.h b/src/corelib/tools/qvector.h index bfc7f2380f..9c8d9d4cf8 100644 --- a/src/corelib/tools/qvector.h +++ b/src/corelib/tools/qvector.h @@ -327,9 +327,11 @@ inline QVector<T>::QVector(const QVector<T> &v) } else { if (v.d->capacityReserved) { d = Data::allocate(v.d->alloc); + Q_CHECK_PTR(d); d->capacityReserved = true; } else { d = Data::allocate(v.d->size); + Q_CHECK_PTR(d); } if (d->alloc) { copyConstruct(v.d->begin(), v.d->end(), d->begin()); @@ -439,6 +441,7 @@ QVector<T>::QVector(int asize) Q_ASSERT_X(asize >= 0, "QVector::QVector", "Size must be greater than or equal to 0."); if (Q_LIKELY(asize > 0)) { d = Data::allocate(asize); + Q_CHECK_PTR(d); d->size = asize; defaultConstruct(d->begin(), d->end()); } else { @@ -452,6 +455,7 @@ QVector<T>::QVector(int asize, const T &t) Q_ASSERT_X(asize >= 0, "QVector::QVector", "Size must be greater than or equal to 0."); if (asize > 0) { d = Data::allocate(asize); + Q_CHECK_PTR(d); d->size = asize; T* i = d->end(); while (i != d->begin()) @@ -467,6 +471,7 @@ QVector<T>::QVector(std::initializer_list<T> args) { if (args.size() > 0) { d = Data::allocate(args.size()); + Q_CHECK_PTR(d); // std::initializer_list<T>::iterator is guaranteed to be // const T* ([support.initlist]/1), so can be memcpy'ed away from by copyConstruct copyConstruct(args.begin(), args.end(), d->begin()); |