Fix crash in QDBusDemarshaller QStringList extraction

QDBusArgument QStringList extraction operator and QDBusDemarshaller that
implements the extraction do not check the type of the extracted value.
When extracting a QStringList and the value actually is e.g. an array of
bytes the string list extraction will crash as it interprets the bytes as
char pointers.

The fix adds DBus type checks to QDBusArgument QStringList extraction
operator implementations.
The checks are as permissive as possible provided crashes are avoided.

Task-number: QTBUG-22840
Change-Id: I83a98097a7cf36f8448afba81d0ad619cdf864e3
(From Qt5 commit b4398dc4e372dbe829b21423e1a0a93a6a542994)
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>

1 files changed, 52 insertions, 0 deletions

diff --git a/tests/auto/qdbusmarshall/tst_qdbusmarshall.cpp b/tests/auto/qdbusmarshall/tst_qdbusmarshall.cpp
index bf7270e..0ac917c 100644
--- a/tests/auto/qdbusmarshall/tst_qdbusmarshall.cpp
+++ b/tests/auto/qdbusmarshall/tst_qdbusmarshall.cpp
@@ -99,6 +99,9 @@ private slots:
     void demarshallStrings_data();
     void demarshallStrings();
 
+    void demarshallInvalidStringList_data();
+    void demarshallInvalidStringList();
+
 private:
     int fileDescriptorForTest();
 
@@ -1383,5 +1386,54 @@ void tst_QDBusMarshall::demarshallStrings()
     QVERIFY(receiveArg.atEnd());
 }
 
+void tst_QDBusMarshall::demarshallInvalidStringList_data()
+{
+    addBasicTypesColumns();
+
+    // None of the basic types should demarshall to a string list
+    basicNumericTypes_data();
+    basicStringTypes_data();
+
+    // Arrays of non-string type should not demarshall to a string list
+    QList<bool> bools;
+    QTest::newRow("emptyboollist") << qVariantFromValue(bools);
+    bools << false << true << false;
+    QTest::newRow("boollist") << qVariantFromValue(bools);
+
+    // Structures should not demarshall to a QByteArray
+    QTest::newRow("struct of strings")
+            << qVariantFromValue(QVariantList() << QString("foo") << QString("bar"));
+    QTest::newRow("struct of mixed types")
+            << qVariantFromValue(QVariantList() << QString("foo") << int(42) << double(3.14));
+}
+
+void tst_QDBusMarshall::demarshallInvalidStringList()
+{
+    QFETCH(QVariant, value);
+
+    QDBusConnection con = QDBusConnection::sessionBus();
+
+    QVERIFY(con.isConnected());
+
+    QDBusMessage msg = QDBusMessage::createMethodCall(serviceName, objectPath,
+                                                      interfaceName, "ping");
+    QDBusArgument sendArg;
+    sendArg.beginStructure();
+    sendArg.appendVariant(value);
+    sendArg.endStructure();
+    msg.setArguments(QVariantList() << qVariantFromValue(sendArg));
+    QDBusMessage reply = con.call(msg);
+
+    const QDBusArgument receiveArg = qvariant_cast<QDBusArgument>(reply.arguments().at(0));
+    receiveArg.beginStructure();
+
+    QStringList receiveValue;
+    receiveArg >> receiveValue;
+    QCOMPARE(receiveValue, QStringList());
+
+    receiveArg.endStructure();
+    QVERIFY(receiveArg.atEnd());
+}
+
 QTEST_MAIN(tst_QDBusMarshall)
 #include "tst_qdbusmarshall.moc"