1 files changed, 23 insertions, 13 deletions

diff --git a/src/corelib/io/qresource.cpp b/src/corelib/io/qresource.cpp
index 64c20dead2..4b85645a90 100644
--- a/src/corelib/io/qresource.cpp
+++ b/src/corelib/io/qresource.cpp
@@ -1,7 +1,7 @@
 /****************************************************************************
 **
-** Copyright (C) 2014 Digia Plc and/or its subsidiary(-ies).
-** Contact: http://www.qt-project.org/legal
+** Copyright (C) 2015 The Qt Company Ltd.
+** Contact: http://www.qt.io/licensing/
 **
 ** This file is part of the QtCore module of the Qt Toolkit.
 **
@@ -10,9 +10,9 @@
 ** Licensees holding valid commercial Qt licenses may use this file in
 ** accordance with the commercial license agreement provided with the
 ** Software or, alternatively, in accordance with the terms contained in
-** a written agreement between you and Digia. For licensing terms and
-** conditions see http://qt.digia.com/licensing. For further information
-** use the contact form at http://qt.digia.com/contact-us.
+** a written agreement between you and The Qt Company. For licensing terms
+** and conditions see http://www.qt.io/terms-conditions. For further
+** information use the contact form at http://www.qt.io/contact-us.
 **
 ** GNU Lesser General Public License Usage
 ** Alternatively, this file may be used under the terms of the GNU Lesser
@@ -23,8 +23,8 @@
 ** requirements will be met: https://www.gnu.org/licenses/lgpl.html and
 ** http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html.
 **
-** In addition, as a special exception, Digia gives you certain additional
-** rights. These rights are described in the Digia Qt LGPL Exception
+** As a special exception, The Qt Company gives you certain additional
+** rights. These rights are described in The Qt Company LGPL Exception
 ** version 1.1, included in the file LGPL_EXCEPTION.txt in this package.
 **
 ** $QT_END_LICENSE$
@@ -873,10 +873,16 @@ public:
     inline QDynamicBufferResourceRoot(const QString &_root) : root(_root), buffer(0) { }
     inline ~QDynamicBufferResourceRoot() { }
     inline const uchar *mappingBuffer() const { return buffer; }
-    virtual QString mappingRoot() const { return root; }
-    virtual ResourceRootType type() const { return Resource_Buffer; }
+    virtual QString mappingRoot() const Q_DECL_OVERRIDE { return root; }
+    virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_Buffer; }
+
+    // size == -1 means "unknown"
+    bool registerSelf(const uchar *b, int size)
+    {
+        // 5 int "pointers"
+        if (size >= 0 && size < 20)
+            return false;
 
-    bool registerSelf(const uchar *b) {
         //setup the data now
         int offset = 0;
 
@@ -903,6 +909,10 @@ public:
                                 (b[offset+2] << 8) + (b[offset+3] << 0);
         offset += 4;
 
+        // Some sanity checking for sizes. This is _not_ a security measure.
+        if (size >= 0 && (tree_offset >= size || data_offset >= size || name_offset >= size))
+            return false;
+
         if(version == 0x01) {
             buffer = b;
             setSource(b+tree_offset, b+name_offset, b+data_offset);
@@ -950,7 +960,7 @@ public:
         }
     }
     QString mappingFile() const { return fileName; }
-    virtual ResourceRootType type() const { return Resource_File; }
+    virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_File; }
 
     bool registerSelf(const QString &f) {
         bool fromMM = false;
@@ -1009,7 +1019,7 @@ public:
             }
             fromMM = false;
         }
-        if(data && QDynamicBufferResourceRoot::registerSelf(data)) {
+        if (data && QDynamicBufferResourceRoot::registerSelf(data, data_len)) {
             if(fromMM) {
                 unmapPointer = data;
                 unmapLength = data_len;
@@ -1124,7 +1134,7 @@ QResource::registerResource(const uchar *rccData, const QString &resourceRoot)
     }
 
     QDynamicBufferResourceRoot *root = new QDynamicBufferResourceRoot(r);
-    if(root->registerSelf(rccData)) {
+    if (root->registerSelf(rccData, -1)) {
         root->ref.ref();
         QMutexLocker lock(resourceMutex());
         resourceList()->append(root);