diff options
| author | Olivier Goffart <ogoffart@trolltech.com> | 2010-03-03 19:47:13 (GMT) |
|---|---|---|
| committer | Olivier Goffart <ogoffart@trolltech.com> | 2010-03-03 19:59:45 (GMT) |
| commit | a4d7572059b5b56d49d7e0c3f3466686e1dc6e16 (patch) | |
| tree | 12bc849bb0e2ae56e04486e261ab8c80d5a9400f /src/corelib | |
| parent | e98d4aece51fa8691cf33325ab96634fcf9baa81 (diff) | |
| download | Qt-a4d7572059b5b56d49d7e0c3f3466686e1dc6e16.zip Qt-a4d7572059b5b56d49d7e0c3f3466686e1dc6e16.tar.gz Qt-a4d7572059b5b56d49d7e0c3f3466686e1dc6e16.tar.bz2 | |
QVariant: Fix crash when comparing two variant with the same undefined type.
If the type is the same, but not registered, the returned string could be
null (or empty if a empty string was registered)
In that case, QVariant compare() function would access invalid memory.
Protect against that case. qstrcmp returns 0 if 0 is given as a parametter.
Task-number: QTBUG-8700
Reviewed-by: Markus Goetz
Diffstat (limited to 'src/corelib')
| -rw-r--r-- | src/corelib/kernel/qvariant.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/corelib/kernel/qvariant.cpp b/src/corelib/kernel/qvariant.cpp index e1b5825..95b2352 100644 --- a/src/corelib/kernel/qvariant.cpp +++ b/src/corelib/kernel/qvariant.cpp @@ -466,7 +466,8 @@ static bool compare(const QVariant::Private *a, const QVariant::Private *b) * QMetaType::VoidStar, QMetaType::QObjectStar and so forth, is that it wouldn't include * user defined pointer types. */ const char *const typeName = QMetaType::typeName(a->type); - if (typeName[qstrlen(typeName) - 1] == '*') + uint typeNameLen = qstrlen(typeName); + if (typeNameLen > 0 && typeName[typeNameLen - 1] == '*') return *static_cast<void *const *>(a_ptr) == *static_cast<void *const *>(b_ptr); return a_ptr == b_ptr; |