diff options
Diffstat (limited to 'src/corelib/tools/qbitarray.cpp')
| -rw-r--r-- | src/corelib/tools/qbitarray.cpp | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/src/corelib/tools/qbitarray.cpp b/src/corelib/tools/qbitarray.cpp index cc3b8a15cfc..ef30b97a6cb 100644 --- a/src/corelib/tools/qbitarray.cpp +++ b/src/corelib/tools/qbitarray.cpp @@ -7,6 +7,9 @@ #include <qdatastream.h> #include <qdebug.h> #include <qendian.h> + +#include <limits> + #include <string.h> QT_BEGIN_NAMESPACE @@ -921,10 +924,18 @@ QDataStream &operator>>(QDataStream &in, QBitArray &ba) if (in.version() < QDataStream::Qt_6_0) { quint32 tmp; in >> tmp; + if (Q_UNLIKELY(tmp > quint32((std::numeric_limits<qint32>::max)()))) { + in.setStatus(QDataStream::ReadCorruptData); + return in; + } len = tmp; } else { quint64 tmp; in >> tmp; + if (Q_UNLIKELY(tmp > quint64((std::numeric_limits<qsizetype>::max)()))) { + in.setStatus(QDataStream::ReadCorruptData); // ### SizeLimitExeeded + return in; + } len = tmp; } if (len == 0) { |