qiurui
/
qtdeclarative
mirror of https://github.com/qt/qtdeclarative.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

QQmlComponent: Fix heap buffer overflow with bogus input 

Change-Id: I8a725018a5aeb39df370f856cd77d887faa511e3
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
This commit is contained in:
Peter Hartmann 2017-03-15 11:59:14 +01:00
parent b63c210f5a
commit 30dbe57521
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/qml/parser/qqmljslexer.cpp
View File

@ -724,6 +724,11 @@ again:
return multilineStringLiteral ? T_MULTILINE_STRING_LITERAL : T_STRING_LITERAL; return multilineStringLiteral ? T_MULTILINE_STRING_LITERAL : T_STRING_LITERAL;
} else if (_char == QLatin1Char('\\')) { } else if (_char == QLatin1Char('\\')) {
scanChar(); scanChar();
if (_codePtr > _endPtr) {
_errorCode = IllegalEscapeSequence;
_errorMessage = QCoreApplication::translate("QQmlParser", "End of file reached at escape sequence");
return T_ERROR;
}
QChar u; QChar u;

12
tests/auto/qml/qqmlparser/tst_qqmlparser.cpp
View File

@ -49,6 +49,7 @@ private slots:
void qmlParser_data(); void qmlParser_data();
void qmlParser(); void qmlParser();
#endif #endif
void invalidEscapeSequence();
private: private:
QStringList excludedDirs; QStringList excludedDirs;
@ -192,6 +193,17 @@ void tst_qqmlparser::qmlParser()
} }
#endif #endif
void tst_qqmlparser::invalidEscapeSequence()
{
using namespace QQmlJS;
Engine engine;
Lexer lexer(&engine);
lexer.setCode(QLatin1String("\"\\"), 1);
Parser parser(&engine);
parser.parse();
}
QTEST_MAIN(tst_qqmlparser) QTEST_MAIN(tst_qqmlparser)
#include "tst_qqmlparser.moc" #include "tst_qqmlparser.moc"