Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-95188

Out-of-memory in QXmlStreamReader

    XMLWordPrintable

Details

    • c4301be7d (dev), b35f5a187 (6.6), 9b7374791 (tqtc/lts-5.15), f67a497db (dev), b47657093 (dev), b5d66b52d (6.6), c216c3d98 (6.5), 7f7287ab5 (tqtc/lts-6.2), 26940b125 (tqtc/lts-6.2), 4f89eb5a7 (6.6), 21f30acde (tqtc/lts-5.15), 3c2cc469b (6.5)

    Description

      1. Build the attached project.
      2. To visualize the issue, restrict the available memory:
        ulimit -Sv 3200000
        

        That's about 3GB.

      3. Run the resulting program and pass one of the attached xml files:
        ./report 30924.xml
        

        You will see output like:

        terminate called after throwing an instance of 'std::bad_alloc'
          what():  std::bad_alloc
        Aborted (core dumped)
        

      On Qt 5.15, the program still finishes successfully with

      ulimit -Sv 2300000
      

      which is 28% less memory.

      Bisecting qtbase resulted in:

      There are only 'skip'ped commits left to test.
      The first bad commit could be any of:
      3398eeadf617880af38fb540f26273df87ba0b1f
      8dc7761e6d490877af18949c0177097e5c857424
      ecfb5d2d15e586c40ca2e8b097fb77821be8c884
      

      Google's oss-fuzz found these as issues 29302 and 30924.

      Attachments

        1. 29302.xml
          619 kB
        2. 30924.xml
          657 kB
        3. main.cpp
          0.2 kB
        4. report.pro
          0.0 kB

        Issue Links

          No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

              axelspoerl Axel Spoerl
              rlohning Robert Löhning
              Vladimir Minenko Vladimir Minenko
              Alex Blasche Alex Blasche
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: