AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QNetworkCookie: Fix use-after-free

Browse Source 
The code was previously calling indexOf() on a temporary, which
QRegularExpression would create backing storage for.
After 11d1dcc6e2 the internals were made
to use the QStringView path, which inadvertently meant that there was
no storage for the temporary string anymore. So we need to keep it alive
ourselves.

Change-Id: I542da7010934594eba3b93261322963866ed9297
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
This commit is contained in:
Mårten Nordheim 2021-08-25 16:18:04 +02:00
parent 0755eba5e8
commit b3c0537404
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/network/access/qnetworkcookie.cpp
View File

@ -744,9 +744,10 @@ static QDateTime parseDateString(const QByteArray &dateString)
&& (dateString[at + 2] == ':' || dateString[at + 1] == ':')) {
// While the date can be found all over the string the format
// for the time is set and a nice regexp can be used.
QRegularExpressionMatch match;
int pos = QString::fromLatin1(dateString).indexOf(timeRx, at, &match);
if (pos != -1) {
// This string needs to stay for as long as the QRegularExpressionMatch is used,
// or else we get use-after-free issues:
QString dateToString = QString::fromLatin1(dateString);
if (auto match = timeRx.match(dateToString, at); match.hasMatch()) {
QStringList list = match.capturedTexts();
int h = match.captured(1).toInt();
int m = match.captured(2).toInt();