From 880986be2357a1f80827d038d770dc2f80300201 Mon Sep 17 00:00:00 2001 From: Ulf Hermann Date: Fri, 19 Sep 2014 16:12:24 +0200 Subject: Check for integer overflows in places where qAllocMore is used Task-number: QTBUG-41230 Change-Id: I5e932c2540c0bd67f13fab3ae20975d459f82c08 Reviewed-by: Thiago Macieira Reviewed-by: Marc Mutz --- src/corelib/tools/qbytearray.cpp | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/corelib/tools/qbytearray.cpp') diff --git a/src/corelib/tools/qbytearray.cpp b/src/corelib/tools/qbytearray.cpp index a069e441df..f57bcdb424 100644 --- a/src/corelib/tools/qbytearray.cpp +++ b/src/corelib/tools/qbytearray.cpp @@ -123,7 +123,7 @@ int qFindByteArray( int qAllocMore(int alloc, int extra) Q_DECL_NOTHROW { Q_ASSERT(alloc >= 0 && extra >= 0); - Q_ASSERT_X(alloc < (1 << 30) - extra, "qAllocMore", "Requested size is too large!"); + Q_ASSERT_X(alloc <= MaxAllocSize - extra, "qAllocMore", "Requested size is too large!"); unsigned nalloc = qNextPowerOfTwo(alloc + extra); @@ -1545,8 +1545,11 @@ void QByteArray::reallocData(uint alloc, Data::AllocationOptions options) Data::deallocate(d); d = x; } else { - if (options & Data::Grow) + if (options & Data::Grow) { + if (alloc > uint(MaxAllocSize) - uint(sizeof(Data))) + qBadAlloc(); alloc = qAllocMore(alloc, sizeof(Data)); + } Data *x = static_cast(::realloc(d, sizeof(Data) + alloc)); Q_CHECK_PTR(x); x->alloc = alloc; -- cgit v1.2.3