Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-38195

QJSEngine crash in visual c libraries in debug mode

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • P2: Important
    • 5.3.1
    • 5.2.1, 5.3.0 Beta1
    • None
    • Windows 8, QT5.2 & QT5.3, debug mode, msvc2012 32b/64b
    • 932ebc4e7c2a67538a36e311c32e00d434de189e (qtdeclarative)

    Description

      this small script crash QJSEngine in debug mode

      QJSEngine engine;
      engine.evaluate( "var obj = { meth: function(a,b,c) {} }; obj.meth.call(1,2,3); ");
      

      stack trace:

      ...
      qv4functionobject.cpp line 380:
      
      ReturnedValue FunctionPrototype::method_call(CallContext *ctx)
      {
          Scope scope(ctx);
      
          FunctionObject *o = ctx->callData->thisObject.asFunctionObject();
          if (!o)
              return ctx->throwTypeError();
      
          ScopedCallData callData(scope, ctx->callData->argc ? ctx->callData->argc - 1 : 0);
          if (ctx->callData->argc) {
              std::copy(ctx->callData->args + 1,
                        ctx->callData->args + ctx->callData->argc, callData->args);
      
              ^^^^^^^^ crash here *
               
          }
          callData->thisObject = ctx->argument(0);
          return o->call(callData);
      }
      
      • std:copy check the destination buffer size against buffer overflow and callData->args size is 1 (SafeValue[1]) because it's dynamically allocated on the internal engine stack.
        so if you copy more the one parameter visual c complain.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            shausman Simon Hausmann
            eco etienne cochard
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes