mirror of
https://github.com/microsoft/vcpkg.git
synced 2024-12-18 20:47:49 +08:00
03d8d04ee0
* [qtbase] patch CVE-2023-51714 * [qtbase] regenerate version info * bump version db * update version db --------- Co-authored-by: Javier Matos Denizac <javiermat@microsoft.com> Co-authored-by: Billy Robert O'Neal III <bion@microsoft.com>
45 lines
1.8 KiB
Diff
45 lines
1.8 KiB
Diff
From 811b9eef6d08d929af8708adbf2a5effb0eb62d7 Mon Sep 17 00:00:00 2001
|
|
From: Marc Mutz <marc.mutz@qt.io>
|
|
Date: Tue, 12 Dec 2023 22:08:07 +0100
|
|
Subject: [PATCH] HPack: fix incorrect integer overflow check
|
|
|
|
This code never worked:
|
|
|
|
For the comparison with max() - 32 to trigger, on 32-bit platforms (or
|
|
Qt 5) signed interger overflow would have had to happen in the
|
|
addition of the two sizes. The compiler can therefore remove the
|
|
overflow check as dead code.
|
|
|
|
On Qt 6 and 64-bit platforms, the signed integer addition would be
|
|
very unlikely to overflow, but the following truncation to uint32
|
|
would yield the correct result only in a narrow 32-value window just
|
|
below UINT_MAX, if even that.
|
|
|
|
Fix by using the proper tool, qAddOverflow.
|
|
|
|
Pick-to: 6.5 6.2 5.15
|
|
Change-Id: I7599f2e75ff7f488077b0c60b81022591005661c
|
|
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
|
|
(cherry picked from commit ee5da1f2eaf8932aeca02ffea6e4c618585e29e3)
|
|
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
|
|
(cherry picked from commit debeb8878da2dc706ead04b6072ecbe7e5313860)
|
|
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
|
|
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
|
|
---
|
|
|
|
diff --git a/src/network/access/http2/hpacktable.cpp b/src/network/access/http2/hpacktable.cpp
|
|
index c8c5d09..2c728b3 100644
|
|
--- a/src/network/access/http2/hpacktable.cpp
|
|
+++ b/src/network/access/http2/hpacktable.cpp
|
|
@@ -26,7 +26,9 @@
|
|
// for counting the number of references to the name and value would have
|
|
// 32 octets of overhead."
|
|
|
|
- const unsigned sum = unsigned(name.size() + value.size());
|
|
+ size_t sum;
|
|
+ if (qAddOverflow(size_t(name.size()), size_t(value.size()), &sum))
|
|
+ return HeaderSize();
|
|
if (sum > (std::numeric_limits<unsigned>::max() - 32))
|
|
return HeaderSize();
|
|
return HeaderSize(true, quint32(sum + 32));
|