QStringConverter: fix move special member functions of State class
By copying 'd' instead of the (larger, on 32-bit platforms), state_data variadic member, we may corrupt the state (by copying only half the state). Fix by copying state_data instead, which is guaranteed to be the larger of the two. The move-assignment operator must be self-assignment-safe in the moved-from state (Hinnant Criterion), so we need to use memmove(), not memcpy(). [ChangeLog][QtCore][QStringEncoder/Decoder] Fixed a potential data corruption in the move constructor and move-assignment operator on 32-bit platforms. Pick-to: 6.3 6.2 Change-Id: I7bbc475a6eecec618a011b23814cada35ce61d10 Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com> Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io> Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This commit is contained in:
parent
dcd87049bb
commit
87c6e340a9
@ -50,6 +50,8 @@
|
||||
#include <QtCore/qglobal.h> // QT_{BEGIN,END}_NAMESPACE
|
||||
#include <QtCore/qflags.h> // Q_DECLARE_FLAGS
|
||||
|
||||
#include <cstring>
|
||||
|
||||
QT_BEGIN_NAMESPACE
|
||||
|
||||
class QByteArrayView;
|
||||
@ -77,7 +79,8 @@ public:
|
||||
: flags(other.flags),
|
||||
remainingChars(other.remainingChars),
|
||||
invalidChars(other.invalidChars),
|
||||
d{other.d[0], other.d[1]},
|
||||
state_data{other.state_data[0], other.state_data[1],
|
||||
other.state_data[2], other.state_data[3]},
|
||||
clearFn(other.clearFn)
|
||||
{ other.clearFn = nullptr; }
|
||||
State &operator=(State &&other) noexcept
|
||||
@ -86,8 +89,7 @@ public:
|
||||
flags = other.flags;
|
||||
remainingChars = other.remainingChars;
|
||||
invalidChars = other.invalidChars;
|
||||
d[0] = other.d[0];
|
||||
d[1] = other.d[1];
|
||||
std::memmove(state_data, other.state_data, sizeof state_data); // self-assignment-safe
|
||||
clearFn = other.clearFn;
|
||||
other.clearFn = nullptr;
|
||||
return *this;
|
||||
|
Loading…
Reference in New Issue
Block a user