1 files changed, 17 insertions, 7 deletions

diff --git a/src/corelib/text/qbytedata_p.h b/src/corelib/text/qbytedata_p.h
index 9851cd17e0..fcbf82d6ce 100644
--- a/src/corelib/text/qbytedata_p.h
+++ b/src/corelib/text/qbytedata_p.h
@@ -19,6 +19,8 @@
 #include <qbytearray.h>
 #include <QtCore/qlist.h>
 
+#include <climits>
+
 QT_BEGIN_NAMESPACE
 
 // this class handles a list of QByteArrays. It is a variant of QRingBuffer
@@ -103,6 +105,7 @@ public:
     // preferably use this function to read data.
     inline QByteArray read()
     {
+        Q_ASSERT(!isEmpty());
         squeezeFirst();
         bufferCompleteSize -= buffers.first().size();
         return buffers.takeFirst();
@@ -120,8 +123,15 @@ public:
     inline QByteArray read(qint64 amount)
     {
         amount = qMin(byteAmount(), amount);
+        if constexpr (sizeof(qsizetype) == sizeof(int)) { // 32-bit
+            // While we cannot overall have more than INT_MAX memory allocated,
+            // the QByteArrays we hold may be shared copies of each other,
+            // causing byteAmount() to exceed INT_MAX.
+            if (amount > INT_MAX)
+                qBadAlloc(); // what resize() would do if it saw past the truncation
+        }
         QByteArray byteData;
-        byteData.resize(amount);
+        byteData.resize(qsizetype(amount));
         read(byteData.data(), byteData.size());
         return byteData;
     }
@@ -229,9 +239,9 @@ public:
     }
 
     // the number of QByteArrays
-    inline int bufferCount() const
+    qsizetype bufferCount() const
     {
-        return buffers.length();
+        return buffers.size();
     }
 
     inline bool isEmpty() const
@@ -247,7 +257,7 @@ public:
             return buffers.first().size() - firstPos;
     }
 
-    inline QByteArray& operator[](int i)
+    QByteArray &operator[](qsizetype i)
     {
         if (i == 0)
             squeezeFirst();
@@ -256,13 +266,13 @@ public:
     }
 
     inline bool canReadLine() const {
-        int i = 0;
-        if (i < buffers.length()) {
+        qsizetype i = 0;
+        if (i < buffers.size()) {
             if (buffers.at(i).indexOf('\n', firstPos) != -1)
                 return true;
             ++i;
 
-            for (; i < buffers.length(); i++)
+            for (; i < buffers.size(); i++)
                 if (buffers.at(i).contains('\n'))
                     return true;
         }