diff options
| author | Thiago Macieira <thiago.macieira@intel.com> | 2020-04-08 11:42:06 -0300 |
|---|---|---|
| committer | Thiago Macieira <thiago.macieira@intel.com> | 2020-04-09 09:41:56 -0300 |
| commit | 954d66e5720b5dd7d31de62364f5e2a8df0bcac3 (patch) | |
| tree | 7e67f1501bbea4110239db6c1ca7ea49be9740f3 /src | |
| parent | 57a57fda78bab652e3fb79677bd828b0f0b49962 (diff) | |
QCborArray: fix operator[] that extends the array
This was never tested. The infinite loop in QCborContainerPrivate::grow
is the proof.
[ChangeLog][QtCore][QCborArray] Fixed an infinite loop when operator[]
was called with with an index larger than the array's size plus 1.
Change-Id: Ibdc95e9af7bd456a94ecfffd1603df3855c73f20
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
Diffstat (limited to 'src')
| -rw-r--r-- | src/corelib/serialization/qcborvalue.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/corelib/serialization/qcborvalue.cpp b/src/corelib/serialization/qcborvalue.cpp index ebb3665e0c..c45a09ad99 100644 --- a/src/corelib/serialization/qcborvalue.cpp +++ b/src/corelib/serialization/qcborvalue.cpp @@ -956,7 +956,7 @@ QCborContainerPrivate *QCborContainerPrivate::grow(QCborContainerPrivate *d, qsi d = detach(d, index + 1); Q_ASSERT(d); int j = d->elements.size(); - while (j < index) + while (j++ < index) d->append(Undefined()); return d; } |