diff options
| author | Markus Goetz <Markus.Goetz@nokia.com> | 2009-10-27 12:03:23 (GMT) |
|---|---|---|
| committer | Markus Goetz <Markus.Goetz@nokia.com> | 2009-10-27 13:36:10 (GMT) |
| commit | 8135af2cebdaaccefb95f0be149328077d237a89 (patch) | |
| tree | a24a3577d0c04a8f056827f2f9d8b859d691a8fc /src | |
| parent | 138962d1c25a9cbb4375aa09bdeb7901c6536ce1 (diff) | |
| download | Qt-8135af2cebdaaccefb95f0be149328077d237a89.zip Qt-8135af2cebdaaccefb95f0be149328077d237a89.tar.gz Qt-8135af2cebdaaccefb95f0be149328077d237a89.tar.bz2 | |
Fix integer overflow in string.remove len parameter
Task: 262677
Reviewed-by: joao
Diffstat (limited to 'src')
| -rw-r--r-- | src/corelib/tools/qstring.cpp | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/corelib/tools/qstring.cpp b/src/corelib/tools/qstring.cpp index a996f30..55ad28d 100644 --- a/src/corelib/tools/qstring.cpp +++ b/src/corelib/tools/qstring.cpp @@ -1590,12 +1590,12 @@ QString &QString::append(QChar ch) */ QString &QString::remove(int pos, int len) { - if (pos < 0) + if (pos < 0) // count from end of string pos += d->size; if (pos < 0 || pos >= d->size) { // range problems - } else if (pos + len >= d->size) { // pos ok - resize(pos); + } else if (len >= d->size - pos) { + resize(pos); // truncate } else if (len > 0) { detach(); memmove(d->data + pos, d->data + pos + len, |