diff options
| author | Jüri Valdmann <juri.valdmann@qt.io> | 2018-05-08 15:30:37 +0200 |
|---|---|---|
| committer | Jüri Valdmann <juri.valdmann@qt.io> | 2018-05-14 10:52:47 +0000 |
| commit | 8e47474baf06b3884e9173302395dd25fc09eba9 (patch) | |
| tree | 89ef666f1c137d2d2f6a642f890dbc6f7f1f4a49 /tests/auto/corelib/serialization | |
| parent | bff2101994c558855bb7ca3aa374e5d90eae8e0c (diff) | |
QJsonDocument: Avoid overflow of string lengths
The added test case contains the binary JSON equivalent of
["ž"]
with the modification that the string's length has been set to INT_MAX. In
Value::usedStorage this length is used through the pointer d like so
s = sizeof(int) + sizeof(ushort) * qFromLittleEndian(*(int *)d);
Because 2 * INT_MAX is UINT_MAX-1, the expression as a whole evaluates to 2,
which is considered a valid storage size. However, when converting this binary
JSON into ordinary JSON we will attempt to construct a QString of length
INT_MAX.
Fixed by using String::isValid instead of Value::usedStorage. This method
already takes care to avoid the overflow problem. Additionally, I've tried in
this patch to clarify the behavior of Value::isValid a bit by writing it in a
style that is hopefully more amenable to structural induction.
Finally, the test case added in my previous patch had the wrong file extension
and is renamed in this one.
Task-number: QTBUG-61969
Change-Id: I45d891f2467a71d8d105822ef7eb1a73c3efa67a
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Diffstat (limited to 'tests/auto/corelib/serialization')
| -rw-r--r-- | tests/auto/corelib/serialization/json/invalidBinaryData/40.bjson (renamed from tests/auto/corelib/serialization/json/invalidBinaryData/40.json) | bin | 60 -> 60 bytes |
| -rw-r--r-- | tests/auto/corelib/serialization/json/invalidBinaryData/41.bjson | bin | 0 -> 32 bytes |
2 files changed, 0 insertions, 0 deletions
diff --git a/tests/auto/corelib/serialization/json/invalidBinaryData/40.json b/tests/auto/corelib/serialization/json/invalidBinaryData/40.bjson Binary files differindex 277096f8cb..277096f8cb 100644 --- a/tests/auto/corelib/serialization/json/invalidBinaryData/40.json +++ b/tests/auto/corelib/serialization/json/invalidBinaryData/40.bjson diff --git a/tests/auto/corelib/serialization/json/invalidBinaryData/41.bjson b/tests/auto/corelib/serialization/json/invalidBinaryData/41.bjson Binary files differnew file mode 100644 index 0000000000..0b5940ab95 --- /dev/null +++ b/tests/auto/corelib/serialization/json/invalidBinaryData/41.bjson |