Trolltech provides patch to Qt 3 and Qt 4, addressing potential vulnerability [复制链接]

Trolltech provides patch to Qt 3 and Qt 4, addressing potential vulnerability

03 September - 2007


Qt 3 and Qt 4 have a potential vulnerability in QUtf8Decoder, which might cause a one-byte buffer overflow. This problem is not exploitable in Qt 4. To solve the issue, apply the following patches for Qt 3 and Qt 4. The next maintenance release of Qt 4 will have the patch included.

This vulnerability has been assigned CVE-2007-4137.

Thanks to Dirk Mueller of KDE for reporting this vulnerability.

Qt4

--- src/corelib/codecs/qutfcodec.cpp
+++ src/corelib/codecs/qutfcodec.cpp
@@ -140,7 +140,7 @@ void QUtf8Codec::convertToUnicode(QString *target, const char *chars, int len, C
    int originalLength = target->length();
    QString &result = *target;
-    result.resize(originalLength + len); // worst case
+    result.resize(originalLength + len + 1); // worst case
    QChar *qch = result.data() + originalLength;
    uchar ch;
    int invalid = 0;

Qt3

--- src/codecs/qutfcodec.cpp
+++ src/codecs/qutfcodec.cpp
@@ -165,7 +165,7 @@ public:
    QString toUnicode(const char* chars, int len)
    {
    QString result;
-    result.setLength( len ); // worst case
+    result.setLength( len + 1 ); // worst case
    QChar *qch = (QChar *)result.unicode();
    uchar ch;
        int error = -1;