Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-132575

QEasingCurve streaming operators (in/out a QDataStream) will crash

    XMLWordPrintable

Details

    • 78a46bf16 (dev), b22343712 (6.9), fbc7223df (6.8)

    Description

      These are the streaming operators for QEasingCurve:

      QDataStream &operator<<(QDataStream &stream, const QEasingCurve &easing)
      {
          stream << quint8(easing.d_ptr->type);
          stream << quint64(quintptr(easing.d_ptr->func)); // <-- HERE
      
          bool hasConfig = easing.d_ptr->config;
          stream << hasConfig;
          if (hasConfig) {
              stream << easing.d_ptr->config;
          }
          return stream;
      }
      
      QDataStream &operator>>(QDataStream &stream, QEasingCurve &easing)
      {
          QEasingCurve::Type type;
          quint8 int_type;
          stream >> int_type;
          type = static_cast<QEasingCurve::Type>(int_type);
          easing.setType(type);
      
          quint64 ptr_func;
          stream >> ptr_func;
          easing.d_ptr->func = QEasingCurve::EasingFunction(quintptr(ptr_func)); // <-- HERE
      
          bool hasConfig;
          stream >> hasConfig;
          delete easing.d_ptr->config;
          easing.d_ptr->config = nullptr;
          if (hasConfig) {
              QEasingCurveFunction *config = curveToFunctionObject(type);
              stream >> config;
              easing.d_ptr->config = config;
          }
          return stream;
      }
      

      The lines marked // <-- HERE stream out a function pointer as an integer and then try to set it back to what it was.

      Needless to say, unless this happens in the very same process, this will never work, and will instead crash a program.

      I propose to delete these operators (API/ABI break) since we can't keep backwards compatibility anyhow, and QDataStream does not have a way to signal protocol errors.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            cnn Qt Core & Network
            peppe Giuseppe D'Angelo
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There is 1 open Gerrit change