Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-138562

QLocalePrivate::codeToLanguage() does not sanitize the input before passing it to AlphaCode

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • P2: Important
    • None
    • 6.6.3, 6.7.3, 6.8.4, 6.9.1, 6.10.0 Beta2
    • Core: Locales (i18n)
    • None
    • 2
    • Foundation Sprint 134

    Description

      qtbase/3dcd6b7ec98b2edf9654bcefdb83134c4c3d2a38 changed AlphaCode from a char[4] to an uint16_t c1:5, c2:5, c3:5, reserved:1, halving the structure size from four to 2 bytes, but also adding the precondition that the AlphaCode(char, char, char) ctor no longer accepts arbitrary char values, but only those inside the set {'\0', 'a'...'z'} (plus a few theoretical characters above 'z' that are unused, but would still fit into the 5-bit bit-fields).

      The QLocale::codeToLanguage() function, by way of QLocalePrivate::codeToLanguage(), only checks input characters for being <= 0x7F, but that is no longer sufficient. It has to check for <= 'z' && (== 0 || >= 'a') instead.

      Attachments

        Issue Links

          For Gerrit Dashboard: QTBUG-138562
          # Subject Branch Project Status CR V

          Activity

            People

              mmutz Marc Mutz
              mmutz Marc Mutz
              Vladimir Minenko Vladimir Minenko
              Alex Blasche Alex Blasche
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated: