Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-38939

QTextStream crashes when parsing certain file with UTF-8 encoding

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P1: Critical
    • Resolution: Done
    • Affects Version/s: 5.3.0
    • Fix Version/s: 5.3.0
    • Component/s: Core: I/O
    • Labels:
      None
    • Environment:
      Windows 7, Microsoft (R) C/C++ Optimizing Compiler Version 17.00.61030 for x86
    • Commits:
      b23e72a772a5abfdf9784ab80db9a4d620137515

      Description

      Reading a certain binary file with QTextStream / UTF-8 crashes with the RC 5.3.0. This is a regression from Qt 5.2.1.

      See attached example ... when compiled in Debug mode this crashes with both the official Qt 5.3.0 RC package, as well as latest qt-rls:

      ---------------------------
      Microsoft Visual C++ Runtime Library
      ---------------------------
      Debug Error!
      
      Program: ...build-qtextstreamtext-Unnamed-Debug\debug\qtextstreamtext.exe
      
      HEAP CORRUPTION DETECTED: after Normal block (#27107) at 0x00716898.
      CRT detected that the application wrote to memory after end of heap buffer.
      
      
      (Press Retry to debug the application)
      
      ---------------------------
      Abort   Retry   Ignore   
      ---------------------------
      

      Stack trace (probably confusing due to heap/stack corruption):

      0	_free_dbg_nolock	MSVCR110D		0x6ae79e59	
      1	_free_dbg	MSVCR110D		0x6ae79afe	
      2	free	MSVCR110D		0x6ae7b06e	
      3	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b0d60c7	
      4	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b071cd0	
      5	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b06cdf3	
      6	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b293eb4	
      7	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b292652	
      8	QFileSelectorPrivate::~QFileSelectorPrivate	Qt5Cored		0x6b28fe6a	
      9	main	main.cpp	31	0x10416fe	
      10	__tmainCRTStartup	crtexe.c	536	0x1044049	
      11	mainCRTStartup	crtexe.c	377	0x104418d	
      12	BaseThreadInitThunk	KERNEL32		0x7760338a	
      13	__RtlUserThreadStart	ntdll_77b60000		0x77b99f72	
      14	_RtlUserThreadStart	ntdll_77b60000		0x77b99f45	
      

      Valgrind error:

      1987 264
      ==22251== Invalid write of size 2
      ==22251==    at 0x51DF66F: QUtf8BaseTraits::appendUtf16(unsigned short*&, unsigned short) (qutfcodec_p.h:86)
      ==22251==    by 0x51DF703: int QUtf8Functions::fromUtf8<QUtf8BaseTraits, unsigned short*, unsigned char const*>(unsigned char, unsigned short*&, unsigned char const*&, unsigned char const*) (qutfcodec_p.h:194)
      ==22251==    by 0x51DE1DF: QUtf8::convertToUnicode(char const*, int, QTextCodec::ConverterState*) (qutfcodec.cpp:338)
      ==22251==    by 0x51DF199: QUtf8Codec::convertToUnicode(char const*, int, QTextCodec::ConverterState*) const (qutfcodec.cpp:636)
      ==22251==    by 0x4FD3749: QTextCodec::toUnicode(char const*, int, QTextCodec::ConverterState*) const (qtextcodec.h:111)
      ==22251==    by 0x50A4775: QTextStreamPrivate::fillReadBuffer(long long) (qtextstream.cpp:480)
      ==22251==    by 0x50A5046: QTextStreamPrivate::scan(QChar const**, int*, int, QTextStreamPrivate::TokenDelimiter) (qtextstream.cpp:688)
      ==22251==    by 0x50A654B: QTextStream::readLine(long long) (qtextstream.cpp:1578)
      ==22251==    by 0x4016F2: main (main.cpp:31)
      ==22251==  Address 0x90b03cc is 0 bytes after a block of size 32,796 alloc'd
      ==22251==    at 0x4C277AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==22251==    by 0x4EEE923: QArrayData::allocate(unsigned long, unsigned long, unsigned long, QFlags<QArrayData::AllocationOption>) (qarraydata.cpp:101)
      ==22251==    by 0x4FD3D5E: QTypedArrayData<unsigned short>::allocate(unsigned long, QFlags<QArrayData::AllocationOption>) (qarraydata.h:228)
      ==22251==    by 0x4FC136B: QString::QString(int, Qt::Initialization) (qstring.cpp:1460)
      ==22251==    by 0x51DDEFD: QUtf8::convertToUnicode(char const*, int, QTextCodec::ConverterState*) (qutfcodec.cpp:285)
      ==22251==    by 0x51DF199: QUtf8Codec::convertToUnicode(char const*, int, QTextCodec::ConverterState*) const (qutfcodec.cpp:636)
      ==22251==    by 0x4FD3749: QTextCodec::toUnicode(char const*, int, QTextCodec::ConverterState*) const (qtextcodec.h:111)
      ==22251==    by 0x50A4775: QTextStreamPrivate::fillReadBuffer(long long) (qtextstream.cpp:480)
      ==22251==    by 0x50A5046: QTextStreamPrivate::scan(QChar const**, int*, int, QTextStreamPrivate::TokenDelimiter) (qtextstream.cpp:688)
      ==22251==    by 0x50A654B: QTextStream::readLine(long long) (qtextstream.cpp:1578)
      ==22251==    by 0x4016F2: main (main.cpp:31)
      ==22251== 
      

        Attachments

          Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

            Activity

              People

              Assignee:
              thiago Thiago Macieira
              Reporter:
              kkohne Kai Köhne
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Gerrit Reviews

                  There are no open Gerrit changes