39 lines
1.3 KiB
Diff
39 lines
1.3 KiB
Diff
From 7743b020c54b4ac7152be1305ad61c6a8fdc604d Mon Sep 17 00:00:00 2001
|
|
From: peijiankang <peijiankang@kylinos.cn>
|
|
Date: Wed, 31 Jan 2024 13:43:57 +0800
|
|
Subject: [PATCH] qtbase5.11.1-CVE-2023-51714
|
|
|
|
---
|
|
src/network/access/http2/hpacktable.cpp | 8 +++++---
|
|
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/network/access/http2/hpacktable.cpp b/src/network/access/http2/hpacktable.cpp
|
|
index a90ee72d..4f452ad0 100644
|
|
--- a/src/network/access/http2/hpacktable.cpp
|
|
+++ b/src/network/access/http2/hpacktable.cpp
|
|
@@ -40,6 +40,7 @@
|
|
#include "hpacktable_p.h"
|
|
|
|
#include <QtCore/qdebug.h>
|
|
+#include <QtCore/private/qnumeric_p.h>
|
|
|
|
#include <algorithm>
|
|
#include <cstring>
|
|
@@ -60,9 +61,10 @@ HeaderSize entry_size(const QByteArray &name, const QByteArray &value)
|
|
// to reference the name and the value of the entry and two 64-bit integers
|
|
// for counting the number of references to the name and value would have
|
|
// 32 octets of overhead."
|
|
-
|
|
- const unsigned sum = unsigned(name.size()) + value.size();
|
|
- if (std::numeric_limits<unsigned>::max() - 32 < sum)
|
|
+ size_t sum;
|
|
+ if (add_overflow(size_t(name.size()), size_t(value.size()), &sum))
|
|
+ return HeaderSize();
|
|
+ if (sum > (std::numeric_limits<unsigned>::max() - 32))
|
|
return HeaderSize();
|
|
return HeaderSize(true, quint32(sum + 32));
|
|
}
|
|
--
|
|
2.41.0
|
|
|