Details
-
Bug
-
Resolution: Done
-
P2: Important
-
None
-
5.15
-
c9df93bf2763b182cd4396b9224c9584af4dac00 (qt/qtbase/dev)
Description
The enumerator has four valid entries, and the tabPositions array is initialized with 4; however, DockCount is the last entry of the enum, so accessing tabPositions[DockCount] would be out of bounds.
Since toDockPos() might return DockCount (it explicitly does that), the access of the tabPositions array will access element 5 of an array that has only 4 entries.
Reported by coverity with Id 218539: https://scan3.coverity.com/reports.htm#v42553/p10113/fileInstanceId=32993532&defectInstanceId=9019438&mergedDefectId=218539
Attachments
Issue Links
- mentioned in
-
Page Loading...
For Gerrit Dashboard: QTBUG-83983 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
299175,3 | Explicitly prevent out-of-bounds access to tabPositions array | dev | qt/qtbase | Status: MERGED | +2 | 0 |
300975,2 | Explicitly prevent out-of-bounds access to tabPositions array | 5.15 | qt/qtbase | Status: MERGED | +2 | 0 |