QStringConverter: fix move special member functions of State class

By copying 'd' instead of the (larger, on 32-bit platforms),
state_data variadic member, we may corrupt the state (by copying only
half the state).

Fix by copying state_data instead, which is guaranteed to be the
larger of the two.

The move-assignment operator must be self-assignment-safe in the
moved-from state (Hinnant Criterion), so we need to use memmove(), not
memcpy().

[ChangeLog][QtCore][QStringEncoder/Decoder] Fixed a potential data
corruption in the move constructor and move-assignment operator on
32-bit platforms.

Pick-to: 6.3 6.2
Change-Id: I7bbc475a6eecec618a011b23814cada35ce61d10
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This commit is contained in:
Marc Mutz 2022-02-20 16:51:21 +01:00
parent dcd87049bb
commit 87c6e340a9

View File

@ -50,6 +50,8 @@
#include <QtCore/qglobal.h> // QT_{BEGIN,END}_NAMESPACE
#include <QtCore/qflags.h> // Q_DECLARE_FLAGS
#include <cstring>
QT_BEGIN_NAMESPACE
class QByteArrayView;
@ -77,7 +79,8 @@ public:
: flags(other.flags),
remainingChars(other.remainingChars),
invalidChars(other.invalidChars),
d{other.d[0], other.d[1]},
state_data{other.state_data[0], other.state_data[1],
other.state_data[2], other.state_data[3]},
clearFn(other.clearFn)
{ other.clearFn = nullptr; }
State &operator=(State &&other) noexcept
@ -86,8 +89,7 @@ public:
flags = other.flags;
remainingChars = other.remainingChars;
invalidChars = other.invalidChars;
d[0] = other.d[0];
d[1] = other.d[1];
std::memmove(state_data, other.state_data, sizeof state_data); // self-assignment-safe
clearFn = other.clearFn;
other.clearFn = nullptr;
return *this;