From 8f19f142745f3cb0690dcd51cebc66153e396805 Mon Sep 17 00:00:00 2001 From: Sami Rosendahl Date: Fri, 25 Nov 2011 11:13:46 +0200 Subject: Fix crash in QDBusDemarshaller basic string-like type extraction QDBusArgument string extraction operators and QDBusDemarshaller that implements the extraction do not check the type of the extracted value. When extracting string-like basic DBus type that actually is e.g. an integer the string extraction will crash as it blindly attempts to use the integer as a pointer to char. The fix adds DBus type checks to QDBusArgument string type extraction operator implementations. The checks are as permissive as possible provided crashes are avoided. Previously supported functionality of extracting an object path or type signature to a string type is retained. Task-number: QTBUG-22840 Change-Id: I29be1ae592658ca268c65ed692e1d42619d52280 Reviewed-by: Thiago Macieira --- src/dbus/qdbusargument_p.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/dbus/qdbusargument_p.h') diff --git a/src/dbus/qdbusargument_p.h b/src/dbus/qdbusargument_p.h index d8ca442920..3ecb798f31 100644 --- a/src/dbus/qdbusargument_p.h +++ b/src/dbus/qdbusargument_p.h @@ -201,6 +201,7 @@ public: QVariant toVariantInternal(); QDBusArgument::ElementType currentType(); + bool isCurrentTypeStringLike(); public: DBusMessageIter iterator; @@ -208,6 +209,9 @@ public: private: Q_DISABLE_COPY(QDBusDemarshaller) + QString toStringUnchecked(); + QDBusObjectPath toObjectPathUnchecked(); + QDBusSignature toSignatureUnchecked(); }; inline QDBusMarshaller *QDBusArgumentPrivate::marshaller() -- cgit v1.2.3