From 798492ccee75a841dfec0e669a409515f3462350 Mon Sep 17 00:00:00 2001 From: Thiago Macieira Date: Tue, 5 May 2020 11:59:52 -0700 Subject: QCborValue: catch overflow in QByteArray when decoding chunked strings We checked against integer overflow, but not against overflowing the QByteArray size limit. That caused a std::bad_alloc to be thrown, which is bad when decoding unknown data. QCborStreamReader wasn't affected, since it doesn't merge chunks. Change-Id: I99ab0f318b1c43b89888fffd160c36f495fada87 Reviewed-by: Volker Hilsheimer --- src/corelib/serialization/qcborvalue.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/corelib/serialization') diff --git a/src/corelib/serialization/qcborvalue.cpp b/src/corelib/serialization/qcborvalue.cpp index 3bca15d562..89a928d348 100644 --- a/src/corelib/serialization/qcborvalue.cpp +++ b/src/corelib/serialization/qcborvalue.cpp @@ -1636,7 +1636,7 @@ void QCborContainerPrivate::decodeStringFromCbor(QCborStreamReader &reader) if (len == rawlen) { auto oldSize = data.size(); auto newSize = oldSize; - if (!add_overflow(newSize, len, &newSize)) { + if (!add_overflow(newSize, len, &newSize) && newSize < MaxByteArraySize) { if (newSize != oldSize) data.resize(newSize); -- cgit v1.2.3