Details
-
Bug
-
Resolution: Unresolved
-
P2: Important
-
None
-
4.8.0, 6.8.0, 6.9
-
None
-
-
c41aa8961 (dev)
Description
The QTranslator::load(const QLocale &, const QString &, const QString &, const QString &, const QString &) overload calls a find_translation() helper that returns the name of a selected file, which load() passes off to do_load(). Between find_translation() calling to is_readable_file() and do_load() actually opening the file, the reality on disk may have changed, making this a classic example of a TOCTOU (time of choice / time of use) error.
The return from find_translation() should be an open QFile that load() passes to a new overload of do_load() that picks up where the present do_load(const QString &, const QString &) gets round to opening a QFile . Alternatively, find_translation() could call do_load() and return its status.
Noticed by thiago in a related review.