diff options
Diffstat (limited to 'src/corelib/io/qresource.cpp')
-rw-r--r-- | src/corelib/io/qresource.cpp | 22 |
1 files changed, 16 insertions, 6 deletions
diff --git a/src/corelib/io/qresource.cpp b/src/corelib/io/qresource.cpp index ed6bfb4e0d..d9b51cd288 100644 --- a/src/corelib/io/qresource.cpp +++ b/src/corelib/io/qresource.cpp @@ -873,10 +873,16 @@ public: inline QDynamicBufferResourceRoot(const QString &_root) : root(_root), buffer(0) { } inline ~QDynamicBufferResourceRoot() { } inline const uchar *mappingBuffer() const { return buffer; } - virtual QString mappingRoot() const { return root; } - virtual ResourceRootType type() const { return Resource_Buffer; } + virtual QString mappingRoot() const Q_DECL_OVERRIDE { return root; } + virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_Buffer; } + + // size == -1 means "unknown" + bool registerSelf(const uchar *b, int size) + { + // 5 int "pointers" + if (size >= 0 && size < 20) + return false; - bool registerSelf(const uchar *b) { //setup the data now int offset = 0; @@ -903,6 +909,10 @@ public: (b[offset+2] << 8) + (b[offset+3] << 0); offset += 4; + // Some sanity checking for sizes. This is _not_ a security measure. + if (size >= 0 && (tree_offset >= size || data_offset >= size || name_offset >= size)) + return false; + if(version == 0x01) { buffer = b; setSource(b+tree_offset, b+name_offset, b+data_offset); @@ -950,7 +960,7 @@ public: } } QString mappingFile() const { return fileName; } - virtual ResourceRootType type() const { return Resource_File; } + virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_File; } bool registerSelf(const QString &f) { bool fromMM = false; @@ -1009,7 +1019,7 @@ public: } fromMM = false; } - if(data && QDynamicBufferResourceRoot::registerSelf(data)) { + if (data && QDynamicBufferResourceRoot::registerSelf(data, data_len)) { if(fromMM) { unmapPointer = data; unmapLength = data_len; @@ -1124,7 +1134,7 @@ QResource::registerResource(const uchar *rccData, const QString &resourceRoot) } QDynamicBufferResourceRoot *root = new QDynamicBufferResourceRoot(r); - if(root->registerSelf(rccData)) { + if (root->registerSelf(rccData, -1)) { root->ref.ref(); QMutexLocker lock(resourceMutex()); resourceList()->append(root); |