1 files changed, 16 insertions, 6 deletions

diff --git a/src/corelib/io/qresource.cpp b/src/corelib/io/qresource.cpp
index ed6bfb4e0d..d9b51cd288 100644
--- a/src/corelib/io/qresource.cpp
+++ b/src/corelib/io/qresource.cpp
@@ -873,10 +873,16 @@ public:
     inline QDynamicBufferResourceRoot(const QString &_root) : root(_root), buffer(0) { }
     inline ~QDynamicBufferResourceRoot() { }
     inline const uchar *mappingBuffer() const { return buffer; }
-    virtual QString mappingRoot() const { return root; }
-    virtual ResourceRootType type() const { return Resource_Buffer; }
+    virtual QString mappingRoot() const Q_DECL_OVERRIDE { return root; }
+    virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_Buffer; }
+
+    // size == -1 means "unknown"
+    bool registerSelf(const uchar *b, int size)
+    {
+        // 5 int "pointers"
+        if (size >= 0 && size < 20)
+            return false;
 
-    bool registerSelf(const uchar *b) {
         //setup the data now
         int offset = 0;
 
@@ -903,6 +909,10 @@ public:
                                 (b[offset+2] << 8) + (b[offset+3] << 0);
         offset += 4;
 
+        // Some sanity checking for sizes. This is _not_ a security measure.
+        if (size >= 0 && (tree_offset >= size || data_offset >= size || name_offset >= size))
+            return false;
+
         if(version == 0x01) {
             buffer = b;
             setSource(b+tree_offset, b+name_offset, b+data_offset);
@@ -950,7 +960,7 @@ public:
         }
     }
     QString mappingFile() const { return fileName; }
-    virtual ResourceRootType type() const { return Resource_File; }
+    virtual ResourceRootType type() const Q_DECL_OVERRIDE { return Resource_File; }
 
     bool registerSelf(const QString &f) {
         bool fromMM = false;
@@ -1009,7 +1019,7 @@ public:
             }
             fromMM = false;
         }
-        if(data && QDynamicBufferResourceRoot::registerSelf(data)) {
+        if (data && QDynamicBufferResourceRoot::registerSelf(data, data_len)) {
             if(fromMM) {
                 unmapPointer = data;
                 unmapLength = data_len;
@@ -1124,7 +1134,7 @@ QResource::registerResource(const uchar *rccData, const QString &resourceRoot)
     }
 
     QDynamicBufferResourceRoot *root = new QDynamicBufferResourceRoot(r);
-    if(root->registerSelf(rccData)) {
+    if (root->registerSelf(rccData, -1)) {
         root->ref.ref();
         QMutexLocker lock(resourceMutex());
         resourceList()->append(root);