From 9a77171ccc2838c2fd7b666ed9ee9c7ba8ebd488 Mon Sep 17 00:00:00 2001 From: Giuseppe D'Angelo Date: Sat, 24 Mar 2012 08:50:02 +0000 Subject: QHash security fix (1.5/2): qHash two arguments overload support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Algorithmic complexity attacks against hash tables have been known since 2003 (cf. [1, 2]), and they have been left unpatched for years until the 2011 attacks [3] against many libraries / (reference) implementations of programming languages. This patch adds a qHash overload taking two arguments: the value to be hashed, and a uint to be used as a seed for the hash function itself (support the global QHash seed was added in a previous patch). The seed itself is not used just yet; instead, 0 is passed. Compatibility with the one-argument qHash(T) implementation is kept through a catch-all template. [1] http://www.cs.rice.edu/~scrosby/hash/CrosbyWallach_UsenixSec2003.pdf [2] http://perldoc.perl.org/perlsec.html#Algorithmic-Complexity-Attacks [3] http://www.ocert.org/advisories/ocert-2011-003.html Task-number: QTBUG-23529 Change-Id: I1d0a84899476d134db455418c8043a349a7e5317 Reviewed-by: João Abecasis --- src/dbus/qdbusextratypes.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src/dbus/qdbusextratypes.h') diff --git a/src/dbus/qdbusextratypes.h b/src/dbus/qdbusextratypes.h index a905cff590..d8bdf7424c 100644 --- a/src/dbus/qdbusextratypes.h +++ b/src/dbus/qdbusextratypes.h @@ -47,6 +47,7 @@ #include #include #include +#include #ifndef QT_NO_DBUS @@ -55,9 +56,6 @@ QT_BEGIN_HEADER QT_BEGIN_NAMESPACE -// defined in qhash.cpp -Q_CORE_EXPORT uint qHash(const QString &key); - class Q_DBUS_EXPORT QDBusObjectPath { QString m_path; -- cgit v1.2.3