QMetaObject::normalizeSignature avoid reading past the string in case of invalid signature given.

If passed "a(b",  qNormalizeType would return a pointer to the \0 at the end
of the string. We would add \0 to the result (thinking it is ',' or ')' )
And continue to process the memory after the string.

Reviewed-by: Kent Hansen
Task-number: QT-1591

1 files changed, 4 insertions, 2 deletions

diff --git a/tests/auto/qmetaobject/tst_qmetaobject.cpp b/tests/auto/qmetaobject/tst_qmetaobject.cpp
index 62416b1..bb96da1 100644
--- a/tests/auto/qmetaobject/tst_qmetaobject.cpp
+++ b/tests/auto/qmetaobject/tst_qmetaobject.cpp
@@ -714,6 +714,8 @@ void tst_QMetaObject::normalizedSignature_data()
     QTest::newRow("const12") << "void foo(Foo<Bar>const*const *const)" << "void foo(Foo<Bar>*const*const)";
     QTest::newRow("const13") << "void foo(const Foo<Bar>&)" << "void foo(Foo<Bar>)";
     QTest::newRow("const14") << "void foo(Foo<Bar>const&)" << "void foo(Foo<Bar>)";
+
+    QTest::newRow("invalid1") << "a( b" << "a(b";
 }
 
 void tst_QMetaObject::normalizedSignature()
@@ -721,7 +723,7 @@ void tst_QMetaObject::normalizedSignature()
     QFETCH(QString, signature);
     QFETCH(QString, result);
 
-    QCOMPARE(QString::fromLatin1(QMetaObject::normalizedSignature(signature.toLatin1())), result);
+    QCOMPARE(QMetaObject::normalizedSignature(signature.toLatin1()), result.toLatin1());
 }
 
 void tst_QMetaObject::normalizedType_data()
@@ -759,7 +761,7 @@ void tst_QMetaObject::normalizedType()
     QFETCH(QString, type);
     QFETCH(QString, result);
 
-    QCOMPARE(QString::fromLatin1(QMetaObject::normalizedType(type.toLatin1())), result);
+    QCOMPARE(QMetaObject::normalizedType(type.toLatin1()), result.toLatin1());
 }
 
 void tst_QMetaObject::customPropertyType()