From aeb1824a84e61e75ac053abc7ba46c565e4abc7c Mon Sep 17 00:00:00 2001 From: Denis Dzyubenko Date: Thu, 29 Mar 2012 14:56:52 +0200 Subject: Validate size of the input in QJsonDocument::fromBinaryData Change-Id: Ifc1d11b4dfbbe782d4e153118059c9affb833fa4 Reviewed-by: Lars Knoll --- src/corelib/json/qjsondocument.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'src/corelib/json/qjsondocument.cpp') diff --git a/src/corelib/json/qjsondocument.cpp b/src/corelib/json/qjsondocument.cpp index c2204bf696..8fa2cef94e 100644 --- a/src/corelib/json/qjsondocument.cpp +++ b/src/corelib/json/qjsondocument.cpp @@ -224,14 +224,16 @@ const char *QJsonDocument::rawData(int *size) const */ QJsonDocument QJsonDocument::fromBinaryData(const QByteArray &data, DataValidation validation) { + if (data.size() < (int)(sizeof(QJsonPrivate::Header) + sizeof(QJsonPrivate::Base))) + return QJsonDocument(); + QJsonPrivate::Header h; memcpy(&h, data.constData(), sizeof(QJsonPrivate::Header)); QJsonPrivate::Base root; memcpy(&root, data.constData() + sizeof(QJsonPrivate::Header), sizeof(QJsonPrivate::Base)); // do basic checks here, so we don't try to allocate more memory than we can. - if (data.size() < (int)(sizeof(QJsonPrivate::Header) + sizeof(QJsonPrivate::Base)) || - h.tag != QJsonDocument::BinaryFormatTag || h.version != 1u || + if (h.tag != QJsonDocument::BinaryFormatTag || h.version != 1u || sizeof(QJsonPrivate::Header) + root.size > (uint)data.size()) return QJsonDocument(); -- cgit v1.2.3