AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix crash when constructing a QVector with an empty initializer list.

Browse Source 
Data::allocate(0) returns a pointer to read-only memory, updating d->size
will segfault. The safety check for this exists in all other QVector ctors
already.

Change-Id: Ida0fe4182de56ee62c7f91e8652cfafbfd7b8410
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This commit is contained in:
Volker Krause 2014-01-17 13:28:37 +01:00 committed by The Qt Project
parent eae8abbc18
commit ec77f93b38
2 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/corelib/tools/qvector.h
View File

@ -438,11 +438,15 @@ QVector<T>::QVector(int asize, const T &t)
template <typename T>
QVector<T>::QVector(std::initializer_list<T> args)
{
d = Data::allocate(args.size());
// std::initializer_list<T>::iterator is guaranteed to be
// const T* ([support.initlist]/1), so can be memcpy'ed away from by copyConstruct
copyConstruct(args.begin(), args.end(), d->begin());
d->size = int(args.size());
if (args.size() > 0) {
d = Data::allocate(args.size());
// std::initializer_list<T>::iterator is guaranteed to be
// const T* ([support.initlist]/1), so can be memcpy'ed away from by copyConstruct
copyConstruct(args.begin(), args.end(), d->begin());
d->size = int(args.size());
} else {
d = Data::sharedNull();
}
}
#endif

3
tests/auto/corelib/tools/qvector/tst_qvector.cpp
View File

@ -2042,6 +2042,9 @@ void tst_QVector::initializeList()
QVector<QVector<T>> v3;
v3 << v1 << (QVector<T>() << val4) << QVector<T>() << v1;
QCOMPARE(v3, v2);
QVector<T> v4({});
QCOMPARE(v4.size(), 0);
#endif
}