diff options
author | Sami Rosendahl <ext-sami.1.rosendahl@nokia.com> | 2011-11-30 19:36:56 (GMT) |
---|---|---|
committer | Oswald Buddenhagen <oswald.buddenhagen@nokia.com> | 2011-11-30 19:38:30 (GMT) |
commit | e20eaed5c1968e32eca97cf449fa588cfab35a5d (patch) | |
tree | fae8b740521b9e5fb1c530d9c9a5215201a4ad80 /tools | |
parent | 27c322e0f88fa0cccba8cf914655cacb5dae51de (diff) | |
download | Qt-e20eaed5c1968e32eca97cf449fa588cfab35a5d.zip Qt-e20eaed5c1968e32eca97cf449fa588cfab35a5d.tar.gz Qt-e20eaed5c1968e32eca97cf449fa588cfab35a5d.tar.bz2 |
Fix stack overwrite in QDBusDemarshaller
QDBusArgument extraction operators and QDBusDemarshaller that implements
the extraction do not check the type of the extracted value.
Helper function template qIterGet in qdbusdemarshaller.cpp that is used
for extracting basic data types only reserves space from the stack for
the expected type as specified by client.
If the actual type in the DBus parameter is larger stack will be
overwritten in the helper function by at most 7 bytes (expected one byte,
received dbus_uint_64_t of size 8 bytes).
The fix always reserves space for the largest basic type dbus_uint64_t
readable by dbus_message_iter_get_basic API.
See also http://dbus.freedesktop.org/doc/api/html/group__DBusMessage.html#ga41c23a05e552d0574d0444d4693d18ab
PMO 280456
Task-number: QTBUG-22735
Merge-request: 1469
Reviewed-by: thiago
Diffstat (limited to 'tools')
0 files changed, 0 insertions, 0 deletions