Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
6.0.0 Beta4
-
Ubuntu 20.04 LTS 64 bit
clang 10.0.0
Built with qmake
-
638171eb10cfb186a6c47ec052a3b0c5b6449386 (qt/qtbase/dev) c5623e5bb13824ef7d735e8d429278223b2887c1 (qt/qtbase/6.0)
Description
- Build the attached project.
- Run it on the attached input:
./report input.cbor
- Watch the value of "newSize" in line 1583 of qcborvalue.cpp:
data.resize(newSize);
Use a breakpoint, a qDebug() or whatever you prefer.
It will try resizing the QByteArray to 2147483639.
Allocating 2 GiB of memory doesn't seem appropriate for 8 bytes of input.
This is a regression from Qt 5.15. There, the function will return -1 before:
if (newSize > MaxByteArraySize) return -1;
Attachments
Issue Links
- relates to
-
QTBUG-88253 [REG 5.15 -> 6.0] QCborStreamReader allocates 2 GiB for 8 B file
- Closed
For Gerrit Dashboard: QTBUG-88256 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
320808,8 | QCborValue: avoid allocating result if data is insufficient | dev | qt/qtbase | Status: MERGED | +2 | 0 |
322052,3 | QString/QByteArray: add missing Q_CHECK_PTR | dev | qt/qtbase | Status: MERGED | +2 | 0 |
325668,2 | QString/QByteArray: add missing Q_CHECK_PTR | 6.0 | qt/qtbase | Status: MERGED | +2 | 0 |
325670,3 | QCborValue: avoid allocating result if data is insufficient | 5.15 | qt/qtbase | Status: ABANDONED | 0 | 0 |
325672,3 | QCborValue: avoid allocating result if data is insufficient | 6.0 | qt/qtbase | Status: MERGED | +2 | 0 |
326369,2 | fuzzing: Add cbor files which ran out of memory | dev | qt/qtqa | Status: MERGED | +2 | 0 |
326530,2 | fuzzing: Add cbor files which ran out of memory | master | qt/qtqa | Status: MERGED | +2 | 0 |