Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-109781

QXmlStreamReader asserts trying to construct XmlStringRef of negative len on external input

    XMLWordPrintable

Details

    • 6326bec46 (dev), 7e9210a83 (6.5), a13f78144 (6.6), fcca4d667 (tqtc/lts-5.15), df51e4095 (tqtc/lts-6.2), 8695e64c6 (6.5.2), bdc8dc513 (dev), c9478b890 (6.5), 70f48ca97 (6.6), 7076e8e9f (tqtc/lts-6.2)
    • Foundation PM Prioritized

    Description

      1. Build the attached project with a developer build of Qt:
        qt-cmake -S /tmp/report/ && cmake --build . --parallel
        
      2. Run the resulting program and pass the attached xml file:
        ./report 54551.xml 
        

        It crashes with a failed assert:

        ASSERT: "len >= 0" in file /home/qtrob/dev/g++-12.2.0/qt-6.4.1-nowebengine-devbld/qtbase/include/QtCore/../../../../../src/qt-6.4.1/qtbase/src/corelib/text/qstringview.h, line 146
        Aborted (core dumped)
        

      gdb give me this backtrace:

      #0  0x00007ffff70a164c in ?? () from /usr/lib/libc.so.6
      #1  0x00007ffff7051958 in raise () from /usr/lib/libc.so.6
      #2  0x00007ffff703b53d in abort () from /usr/lib/libc.so.6
      #3  0x00007ffff76c3c32 in qAbort ()
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/global/qglobal.cpp:3369
      #4  0x00007ffff76d49be in qt_message_fatal (context=..., message=...)
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/global/qlogging.cpp:1916
      #5  0x00007ffff76d0e82 in QMessageLogger::fatal (this=0x7fffffffda70, 
          msg=0x7ffff7bb5ea8 "ASSERT: \"%s\" in file %s, line %d")
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/global/qlogging.cpp:850
      #6  0x00007ffff76c3a66 in qt_assert (assertion=0x7ffff7bb245a "len >= 0", 
          file=0x7ffff7bb2470 "/home/qtrob/dev/g++-12.2.0/qt-6.4.1-nowebengine-devbld/qtbase/include/QtCore/../../../../../src/qt-6.4.1/qtbase/src/corelib/text/qstringview.h", line=146)
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/global/qglobal.cpp:3276
      #7  0x00007ffff76bed13 in QStringView::QStringView<QChar, true> (
          this=0x7fffffffdaf0, str=0x55555558375e, len=-2325)
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/text/qstringview.h:146
      #8  0x00007ffff7895566 in QtPrivate::XmlStringRef::view (this=0x7fffffffdd20)
          at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/serialization/qxmlstream_p.h:60
      #9  0x00007ffff78954d6 in QtPrivate::XmlStringRef::operator QStringView (
          this=0x7fffffffdd20)
      --Type <RET> for more, q to quit, c to continue without paging--c
         alization/qxmlstream_p.h:57
      #10 0x00007ffff78883e1 in QXmlStreamReaderPrivate::parse (this=0x555555559ff0) at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/serialization/qxmlstreamparser_p.h:789
      #11 0x00007ffff788a83f in QXmlStreamReader::readNext (this=0x7fffffffde58) at /home/qtrob/dev/src/qt-6.4.1/qtbase/src/corelib/serialization/qxmlstream.cpp:561
      #12 0x00005555555552ec in main ()
      

      Google's oss-fuzz found this as issue 54551. They will publish their report on March 24th, the latest.

      Attachments

        1. CMakeLists.txt
          0.3 kB
          Robert Löhning
        2. main.cpp
          0.3 kB
          Robert Löhning
        3. 54551.xml
          8 kB
          Robert Löhning

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              thiago Thiago Macieira
              rlohning Robert Löhning
              Vladimir Minenko Vladimir Minenko
              Alex Blasche Alex Blasche
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: