AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tst_QIODevice: fix UB (precondition violation) in SequentialReadBuffer::readData()

Browse Source 
memcpy() mustn't be called with a nullptr, even if the size is zero.

Fixes ubsan error:

   tst_qiodevice.cpp:561:15: runtime error: null pointer passed as argument 1, which is declared to never be null

Even though ubsan only complained about one of them, fix all three
occurrences of the pattern in the test.

Pick-to: 6.3 6.2 5.15
Change-Id: I5c06ab4a20a9e9f8831392c46c6969c05248fdac
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
This commit is contained in:
Marc Mutz 2021-12-16 09:31:39 +01:00
parent b1938e5787
commit 572b55baa4
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
tests/auto/corelib/io/qiodevice/tst_qiodevice.cpp
View File

@ -558,7 +558,8 @@ protected:
qint64 readData(char *data, qint64 maxSize) override qint64 readData(char *data, qint64 maxSize) override
{ {
maxSize = qMin(maxSize, qint64(buf->size() - offset)); maxSize = qMin(maxSize, qint64(buf->size() - offset));
memcpy(data, buf->constData() + offset, maxSize); if (maxSize > 0)
memcpy(data, buf->constData() + offset, maxSize);
offset += maxSize; offset += maxSize;
return maxSize; return maxSize;
} }
@ -601,13 +602,15 @@ protected:
qint64 readData(char *data, qint64 maxSize) override qint64 readData(char *data, qint64 maxSize) override
{ {
maxSize = qMin(maxSize, qint64(buf.size() - pos())); maxSize = qMin(maxSize, qint64(buf.size() - pos()));
memcpy(data, buf.constData() + pos(), maxSize); if (maxSize > 0)
memcpy(data, buf.constData() + pos(), maxSize);
return maxSize; return maxSize;
} }
qint64 writeData(const char *data, qint64 maxSize) override qint64 writeData(const char *data, qint64 maxSize) override
{ {
maxSize = qMin(maxSize, qint64(buf.size() - pos())); maxSize = qMin(maxSize, qint64(buf.size() - pos()));
memcpy(buf.data() + pos(), data, maxSize); if (maxSize > 0)
memcpy(buf.data() + pos(), data, maxSize);
return maxSize; return maxSize;
} }