QV4::Scope: Forbid calling alloc with qint64

Calling  alloc with a qint64 parameter is a good indicator that we got
that value from Object::getLength. In that case, the value needs to be
sanitized with safeForAllocLength.

As a consequence, we notice that method_stringify did indeed use alloc
in an usasafe way; this is now fixed.
In a few other places, variables had to be changed from unsigned to
signed int (as the conversion is now ambiguous).

An even stricter check would be to only accepd a value of (not yet
existing) "sanitized_size_t" type. However, that requires more effort,
at it would each and every call-site, and is thus left as an exercise
for later.

Pick-to: 6.4 6.2 5.15
Fixes: QTBUG-107619
Change-Id: I3bba9be1e0aea72e11ccb6c168219b4591eb8f5b
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

1 files changed, 5 insertions, 1 deletions

diff --git a/src/qml/jsruntime/qv4scopedvalue_p.h b/src/qml/jsruntime/qv4scopedvalue_p.h
index fd68fcc1b3..ddd312b893 100644
--- a/src/qml/jsruntime/qv4scopedvalue_p.h
+++ b/src/qml/jsruntime/qv4scopedvalue_p.h
@@ -93,6 +93,10 @@ struct Scope {
         /* Be careful when using Uninitialized, the stack has to be fully initialized before calling into the memory manager again */
         Uninitialized
     };
+
+    template <AllocMode mode = Undefined>
+    Value *alloc(qint64 nValues) const = delete; // use safeForAllocLength
+
     template <AllocMode mode = Undefined>
     QML_NEARLY_ALWAYS_INLINE Value *alloc(int nValues) const
     {
@@ -413,7 +417,7 @@ struct ScopedProperty
 {
     ScopedProperty(Scope &scope)
     {
-        property = reinterpret_cast<Property*>(scope.alloc(sizeof(Property) / sizeof(Value)));
+        property = reinterpret_cast<Property*>(scope.alloc(int(sizeof(Property) / sizeof(Value))));
     }
 
     Property *operator->() { return property; }