AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Do Q_CHECK_PTR on all results of QArrayData::allocate()

Browse Source 
QArrayData::allocate() uses malloc() which can return 0. We need to
check for that when using it inside other containers. The containers
might otherwise return a seemingly valid result from some allocating
operation which is actually corrupt.

Task-number: QTBUG-41231
Change-Id: I16cc6035e4f495f519bd38bf29cee080ee0637f6
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Marc Mutz <marc.mutz@kdab.com>
This commit is contained in:
Ulf Hermann 2014-09-19 14:06:11 +02:00 committed by Marc Mutz
parent f93870ed44
commit 9d44645eae
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/corelib/tools/qarraydatapointer.h
View File

@ -169,8 +169,10 @@ public:
private:
Data *clone(QArrayData::AllocationOptions options) const Q_REQUIRED_RESULT
{
QArrayDataPointer copy(Data::allocate(d->detachCapacity(d->size),
options));
Data *x = Data::allocate(d->detachCapacity(d->size), options);
Q_CHECK_PTR(x);
QArrayDataPointer copy(x);
if (d->size)
copy->copyAppend(d->begin(), d->end());

5
src/corelib/tools/qvector.h
View File

@ -327,9 +327,11 @@ inline QVector<T>::QVector(const QVector<T> &v)
} else {
if (v.d->capacityReserved) {
d = Data::allocate(v.d->alloc);
Q_CHECK_PTR(d);
d->capacityReserved = true;
} else {
d = Data::allocate(v.d->size);
Q_CHECK_PTR(d);
}
if (d->alloc) {
copyConstruct(v.d->begin(), v.d->end(), d->begin());
@ -439,6 +441,7 @@ QVector<T>::QVector(int asize)
Q_ASSERT_X(asize >= 0, "QVector::QVector", "Size must be greater than or equal to 0.");
if (Q_LIKELY(asize > 0)) {
d = Data::allocate(asize);
Q_CHECK_PTR(d);
d->size = asize;
defaultConstruct(d->begin(), d->end());
} else {
@ -452,6 +455,7 @@ QVector<T>::QVector(int asize, const T &t)
Q_ASSERT_X(asize >= 0, "QVector::QVector", "Size must be greater than or equal to 0.");
if (asize > 0) {
d = Data::allocate(asize);
Q_CHECK_PTR(d);
d->size = asize;
T* i = d->end();
while (i != d->begin())
@ -467,6 +471,7 @@ QVector<T>::QVector(std::initializer_list<T> args)
{
if (args.size() > 0) {
d = Data::allocate(args.size());
Q_CHECK_PTR(d);
// std::initializer_list<T>::iterator is guaranteed to be
// const T* ([support.initlist]/1), so can be memcpy'ed away from by copyConstruct
copyConstruct(args.begin(), args.end(), d->begin());