Fix possible crash when passing an invalid PAC URL

This commit checks whether CFURLCreateWithString() succeeded.

It does not appear to be possible to enter an empty URL directly in the
PAC configuration dialog but I can't rule out the possibility
that it could find its way into the settings via some other means.

Change-Id: I6c2053d385503bf0330f5ae9fb1ec36a473d425d
Patch-By: Robert Knight
Task-number: QTBUG-36787
Reviewed-by: Markus Goetz <markus@woboq.com>
Reviewed-by: Peter Hartmann <phartmann@blackberry.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/src/network/kernel/qnetworkproxy_mac.cpp b/src/network/kernel/qnetworkproxy_mac.cpp
index 81bce0c300..6be032ed9b 100644
--- a/src/network/kernel/qnetworkproxy_mac.cpp
+++ b/src/network/kernel/qnetworkproxy_mac.cpp
@@ -230,6 +230,10 @@ QList<QNetworkProxy> macQueryInternal(const QNetworkProxyQuery &query)
             if (QSysInfo::MacintoshVersion >= QSysInfo::MV_10_5) {
                 QCFType<CFDataRef> pacData;
                 QCFType<CFURLRef> pacUrl = CFURLCreateWithString(kCFAllocatorDefault, cfPacLocation, NULL);
+                if (!pacUrl) {
+                    qWarning("Invalid PAC URL \"%s\"", qPrintable(QCFString::toQString(cfPacLocation)));
+                    return result;
+                }
                 SInt32 errorCode;
                 if (!CFURLCreateDataAndPropertiesFromResource(kCFAllocatorDefault, pacUrl, &pacData, NULL, NULL, &errorCode)) {
                     QString pacLocation = QCFString::toQString(cfPacLocation);