diff options
| author | Marc Mutz <marc.mutz@qt.io> | 2025-04-25 13:58:25 +0200 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@qt.io> | 2025-04-28 23:54:58 +0000 |
| commit | 4d839093b480d30eef8a89c0f864ee3f340adaa1 (patch) | |
| tree | e5b691f6b2e8d5b585e217ea45334382a5d251a9 /src/corelib/io/qdataurl.cpp | |
| parent | 0bdbf4688e4265a1ddf42efbe4c780770809d365 (diff) | |
qDecodeDataUrl(): fix precondition violation in call to QByteArrayView::at()
It is a precondition violation to call QByteArrayView::at() with
size() as argument. The code used that, though, as an implicit
end-of-string check, assuming == ' ' and == '=' would both fail for
null bytes. Besides, QByteArrays (but most certainly QByteArrayViews)
need not be null-terminated, so this could read even past size().
To fix, use higher-level API (startsWith()), consuming parsed tokens
along the way.
Add a test that would crash in debug mode before the fix.
Amends the start of the public history.
[ChangeLog][QtCore] Fixed a bug in the handling of data: URLs that
could lead to a crash if Qt was built with assertions enabled. This
affects QNetworkManager and links in QTextDocument.
Pick-to: 6.9 6.8 6.5 6.5.9 6.2 5.15
Change-Id: I4331c88051dfbb0a18fe7da4f50858c707785d09
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Ahmad Samir <a.samirh78@gmail.com>
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
Diffstat (limited to 'src/corelib/io/qdataurl.cpp')
| -rw-r--r-- | src/corelib/io/qdataurl.cpp | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/corelib/io/qdataurl.cpp b/src/corelib/io/qdataurl.cpp index 65b934b3f67..c5ecca8fb82 100644 --- a/src/corelib/io/qdataurl.cpp +++ b/src/corelib/io/qdataurl.cpp @@ -47,10 +47,10 @@ Q_CORE_EXPORT bool qDecodeDataUrl(const QUrl &uri, QString &mimeType, QByteArray QLatin1StringView textPlain; constexpr auto charset = "charset"_L1; if (QLatin1StringView{data}.startsWith(charset, Qt::CaseInsensitive)) { - qsizetype i = charset.size(); - while (data.at(i) == ' ') - ++i; - if (data.at(i) == '=') + QByteArrayView copy = data.sliced(charset.size()); + while (copy.startsWith(' ')) + copy.slice(1); + if (copy.startsWith('=')) textPlain = "text/plain;"_L1; } |