Loading...

Details

Type: Bug
Resolution: Unresolved
Priority: P2: Important
Fix Version/s: None
Affects Version/s: dev
Component/s: Widgets: Style Sheets
Labels:
None

Platform/s:

Windows

Description

Spotted with ASAN with the following code:

#include <QtWidgets>

int main(int argc, char *argv[])
{
    QApplication app(argc, argv);

    QWidget* my = new QWidget;
    my->setStyleSheet("background-color: red");

    return app.exec();
}

11:28:59: Starting C:\dev\temp\widgets-qt_dev_debug-Debug\widgets.exe...
=================================================================
==33132==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7ffbd65d5a80 at pc 0x7ffbd84347cd bp 0x00b6ef8f12d0 sp 0x00b6ef8f12d0
READ of size 8 at 0x7ffbd65d5a80 thread T0
    #0 0x7ffbd84347cc in QMetaType::canConvert(class QMetaType, class QMetaType) C:\dev\qt-dev\qtbase\src\corelib\kernel\qmetatype.cpp:2560
    #1 0x7ffbd80984cc in QVariant::canConvert(class QMetaType) const C:\dev\qt-dev\qtbase\src\corelib\kernel\qvariant.h:343
    #2 0x7ffbd85b6dee in QVariant::convert(class QMetaType) C:\dev\qt-dev\qtbase\src\corelib\kernel\qvariant.cpp:2120
    #3 0x7ffbd5d50055 in parseColorValue C:\dev\qt-dev\qtbase\src\gui\text\qcssparser.cpp:687
    #4 0x7ffbd5d53078 in parseBrushValue C:\dev\qt-dev\qtbase\src\gui\text\qcssparser.cpp:787
    #5 0x7ffbd5d22167 in QCss::Declaration::brushValue(class QPalette const &) const C:\dev\qt-dev\qtbase\src\gui\text\qcssparser.cpp:1479
    #6 0x7ffbd5d39248 in QCss::ValueExtractor::extractBackground(class QBrush *, class QString *, enum QCss::Repeat *, class QFlags<enum Qt::AlignmentFlag> *, enum QCss::Origin *, enum QCss::Attachment *, enum QCss::Origin *) C:\dev\qt-dev\qtbase\src\gui\text\qcssparser.cpp:1045
    #7 0x7ffbd9db1dcd in QRenderRule::QRenderRule(class QList<struct QCss::Declaration> const &, class QObject const *) C:\dev\qt-dev\qtbase\src\widgets\styles\qstylesheetstyle.cpp:956
    #8 0x7ffbd9da0fc9 in QStyleSheetStyle::renderRule(class QObject const *, int, unsigned __int64) const C:\dev\qt-dev\qtbase\src\widgets\styles\qstylesheetstyle.cpp:1892
    #9 0x7ffbd9da88d3 in QStyleSheetStyle::setGeometry(class QWidget *) C:\dev\qt-dev\qtbase\src\widgets\styles\qstylesheetstyle.cpp:2611
    #10 0x7ffbd9d86f4c in QStyleSheetStyle::polish(class QWidget *) C:\dev\qt-dev\qtbase\src\widgets\styles\qstylesheetstyle.cpp:2925
    #11 0x7ffbd9bcf055 in QWidget::event(class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qwidget.cpp:9090
    #12 0x7ffbd99c4b37 in QApplicationPrivate::notify_helper(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qapplication.cpp:3290
    #13 0x7ffbd99bef44 in QApplication::notify(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qapplication.cpp:3237
    #14 0x7ffbd83628d3 in QCoreApplication::notifyInternal2(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1134
    #15 0x7ffbd835bba0 in QCoreApplication::sendEvent(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1575
    #16 0x7ffbd9bccbe4 in QWidget::ensurePolished(void) const C:\dev\qt-dev\qtbase\src\widgets\kernel\qwidget.cpp:10231
    #17 0x7ffbd9bcef80 in QWidget::event(class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qwidget.cpp:9086
    #18 0x7ffbd99c4b37 in QApplicationPrivate::notify_helper(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qapplication.cpp:3290
    #19 0x7ffbd99bef44 in QApplication::notify(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\widgets\kernel\qapplication.cpp:3237
    #20 0x7ffbd83628d3 in QCoreApplication::notifyInternal2(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1134
    #21 0x7ffbd835bba0 in QCoreApplication::sendEvent(class QObject *, class QEvent *) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1575
    #22 0x7ffbd836852c in QCoreApplicationPrivate::sendPostedEvents(class QObject *, int, class QThreadData *) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1932
    #23 0x7ffbd8b849e3 in QEventDispatcherWin32::sendPostedEvents(void) C:\dev\qt-dev\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp:899
    #24 0x7ffbd58edcc3 in QWindowsGuiEventDispatcher::sendPostedEvents(void) C:\dev\qt-dev\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:43
    #25 0x7ffbd8b7f585 in QEventDispatcherWin32::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) C:\dev\qt-dev\qtbase\src\corelib\kernel\qeventdispatcher_win.cpp:468
    #26 0x7ffbd58edc7c in QWindowsGuiEventDispatcher::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) C:\dev\qt-dev\qtbase\src\gui\platform\windows\qwindowsguieventdispatcher.cpp:36
    #27 0x7ffbd83affec in QEventLoop::processEvents(class QFlags<enum QEventLoop::ProcessEventsFlag>) C:\dev\qt-dev\qtbase\src\corelib\kernel\qeventloop.cpp:100
    #28 0x7ffbd83b0819 in QEventLoop::exec(class QFlags<enum QEventLoop::ProcessEventsFlag>) C:\dev\qt-dev\qtbase\src\corelib\kernel\qeventloop.cpp:182
    #29 0x7ffbd835b470 in QCoreApplication::exec(void) C:\dev\qt-dev\qtbase\src\corelib\kernel\qcoreapplication.cpp:1478
    #30 0x7ffbd48bff07 in QGuiApplication::exec(void) C:\dev\qt-dev\qtbase\src\gui\kernel\qguiapplication.cpp:1926
    #31 0x7ffbd99b8e59 in QApplication::exec(void) C:\dev\qt-dev\qtbase\src\widgets\kernel\qapplication.cpp:2568
    #32 0x7ff7edb2177a in main C:\dev\temp\widgets\main.cpp:22
    #33 0x7ff7edb2b6e9 in qtEntryPoint C:\dev\qt-dev\qtbase\src\entrypoint\qtentrypoint_win.cpp:50
    #34 0x7ff7edb2b13c in WinMain C:\dev\qt-dev\qtbase\src\entrypoint\qtentrypoint_win.cpp:59
    #35 0x7ff7edb265a1 in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:102
    #36 0x7ff7edb264fd in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #37 0x7ff7edb263bd in __scrt_common_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:330
    #38 0x7ff7edb2661d in WinMainCRTStartup D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_winmain.cpp:16
    #39 0x7ffc984b257c  (C:\WINDOWS\System32\KERNEL32.DLL+0x18001257c)
    #40 0x7ffc996eaa57  (C:\WINDOWS\SYSTEM32\ntdll.dll+0x18005aa57)

0x7ffbd65d5a80 is located 0 bytes inside of global variable '`anonymous namespace'::qVariantGuiHelper' defined in 'qguivariant.cpp:135:2' (0x7ffbd65d5a80) of size 8
0x7ffbd65d5a80 is located 96 bytes to the right of global variable '`anonymous namespace'::<unnamed-type-qVariantGuiHelper>::`vftable'' defined in 'qguivariant.cpp:59:20' (0x7ffbd65d5a08) of size 24
SUMMARY: AddressSanitizer: global-buffer-overflow C:\dev\qt-dev\qtbase\src\corelib\kernel\qmetatype.cpp:2560 in QMetaType::canConvert(class QMetaType, class QMetaType)
Shadow bytes around the buggy address:
  0x127623e3ab00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab40: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
=>0x127623e3ab50:[f9]f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x127623e3ab60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3ab90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x127623e3aba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==33132==ABORTING
11:28:59: C:\dev\temp\widgets-qt_dev_debug-Debug\widgets.exe exited with code 1

Attachments

Gerrit Reviews

- Issue Only
- Show All Reviews
- Show Open Reviews

No reviews matched the request. Check your Options in the drop-down menu of this sections header.

Buffer overflow when setting stylesheet on widget

Details

Description

Attachments

Gerrit Reviews

Activity

People

Dates

Gerrit Reviews