3 files changed, 7 insertions, 6 deletions
diff --git a/src/corelib/serialization/qjson.cpp b/src/corelib/serialization/qjson.cpp
index e4bca3bcd0..592f6168dc 100644
--- a/src/corelib/serialization/qjson.cpp
+++ b/src/corelib/serialization/qjson.cpp
@@ -328,7 +328,7 @@ int Value::usedStorage(const Base *b) const
 
 bool Value::isValid(const Base *b) const
 {
-    int offset = 0;
+    int offset = -1;
     switch (type) {
     case QJsonValue::Double:
         if (latinOrIntValue)
@@ -345,14 +345,12 @@ bool Value::isValid(const Base *b) const
         break;
     }
 
-    if (!offset)
+    if (offset == -1)
         return true;
-    if (offset + sizeof(uint) > b->tableOffset)
+    if (offset + sizeof(uint) > b->tableOffset || offset < (int)sizeof(Base))
         return false;
 
     int s = usedStorage(b);
-    if (!s)
-        return true;
     if (s < 0 || s > (int)b->tableOffset - offset)
         return false;
     if (type == QJsonValue::Array)
diff --git a/src/corelib/serialization/qjson_p.h b/src/corelib/serialization/qjson_p.h
index 7743382806..dc56a49084 100644
--- a/src/corelib/serialization/qjson_p.h
+++ b/src/corelib/serialization/qjson_p.h
@@ -450,7 +450,7 @@ static inline void copyString(char *dest, const QString &str, bool compress)
 
 
 /*
- Base is the base class for both Object and Array. Both classe work more or less the same way.
+ Base is the base class for both Object and Array. Both classes work more or less the same way.
  The class starts with a header (defined by the struct below), then followed by data (the data for
  values in the Array case and Entry's (see below) for objects.
 
diff --git a/src/corelib/serialization/qjsondocument.cpp b/src/corelib/serialization/qjsondocument.cpp
index 9794bca60d..ab27b45fda 100644
--- a/src/corelib/serialization/qjsondocument.cpp
+++ b/src/corelib/serialization/qjsondocument.cpp
@@ -210,6 +210,9 @@ QJsonDocument QJsonDocument::fromRawData(const char *data, int size, DataValidat
         return QJsonDocument();
     }
 
+    if (size < (int)(sizeof(QJsonPrivate::Header) + sizeof(QJsonPrivate::Base)))
+        return QJsonDocument();
+
     QJsonPrivate::Data *d = new QJsonPrivate::Data((char *)data, size);
     d->ownsData = false;