MSVSphere Packaging Team
1 year ago
parent
67554625de
commit
495d35a733
@ -0,0 +1,13 @@
|
|||||||
|
--- a/src/network/access/qhsts.cpp
|
||||||
|
+++ b/src/network/access/qhsts.cpp
|
||||||
|
@@ -364,8 +364,8 @@ quoted-pair = "\" CHAR
|
||||||
|
bool QHstsHeaderParser::parse(const QList<QPair<QByteArray, QByteArray>> &headers)
|
||||||
|
{
|
||||||
|
for (const auto &h : headers) {
|
||||||
|
- // We use '==' since header name was already 'trimmed' for us:
|
||||||
|
- if (h.first == "Strict-Transport-Security") {
|
||||||
|
+ // We compare directly because header name was already 'trimmed' for us:
|
||||||
|
+ if (h.first.compare("Strict-Transport-Security", Qt::CaseInsensitive) == 0) {
|
||||||
|
header = h.second;
|
||||||
|
// RFC6797, 8.1:
|
||||||
|
//
|
||||||
@ -0,0 +1,49 @@
|
|||||||
|
diff --git a/src/gui/painting/qfixed_p.h b/src/gui/painting/qfixed_p.h
|
||||||
|
index 84659288..57d750a4 100644
|
||||||
|
--- a/src/gui/painting/qfixed_p.h
|
||||||
|
+++ b/src/gui/painting/qfixed_p.h
|
||||||
|
@@ -54,6 +54,7 @@
|
||||||
|
#include <QtGui/private/qtguiglobal_p.h>
|
||||||
|
#include "QtCore/qdebug.h"
|
||||||
|
#include "QtCore/qpoint.h"
|
||||||
|
+#include <QtCore/private/qnumeric_p.h>
|
||||||
|
#include "QtCore/qsize.h"
|
||||||
|
|
||||||
|
QT_BEGIN_NAMESPACE
|
||||||
|
@@ -182,6 +183,14 @@ Q_DECL_CONSTEXPR inline bool operator<(int i, const QFixed &f) { return i * 64 <
|
||||||
|
Q_DECL_CONSTEXPR inline bool operator>(const QFixed &f, int i) { return f.value() > i * 64; }
|
||||||
|
Q_DECL_CONSTEXPR inline bool operator>(int i, const QFixed &f) { return i * 64 > f.value(); }
|
||||||
|
|
||||||
|
+inline bool qAddOverflow(QFixed v1, QFixed v2, QFixed *r)
|
||||||
|
+{
|
||||||
|
+ int val;
|
||||||
|
+ bool result = add_overflow(v1.value(), v2.value(), &val);
|
||||||
|
+ r->setValue(val);
|
||||||
|
+ return result;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#ifndef QT_NO_DEBUG_STREAM
|
||||||
|
inline QDebug &operator<<(QDebug &dbg, const QFixed &f)
|
||||||
|
{ return dbg << f.toReal(); }
|
||||||
|
diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp
|
||||||
|
index 26ac37b0..f6c69ff4 100644
|
||||||
|
--- a/src/gui/text/qtextlayout.cpp
|
||||||
|
+++ b/src/gui/text/qtextlayout.cpp
|
||||||
|
@@ -2150,11 +2150,14 @@ found:
|
||||||
|
eng->maxWidth = qMax(eng->maxWidth, line.textWidth);
|
||||||
|
} else {
|
||||||
|
eng->minWidth = qMax(eng->minWidth, lbh.minw);
|
||||||
|
- eng->maxWidth += line.textWidth;
|
||||||
|
+ if (qAddOverflow(eng->maxWidth, line.textWidth, &eng->maxWidth))
|
||||||
|
+ eng->maxWidth = QFIXED_MAX;
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (line.textWidth > 0 && item < eng->layoutData->items.size())
|
||||||
|
- eng->maxWidth += lbh.spaceData.textWidth;
|
||||||
|
+ if (line.textWidth > 0 && item < eng->layoutData->items.size()) {
|
||||||
|
+ if (qAddOverflow(eng->maxWidth, lbh.spaceData.textWidth, &eng->maxWidth))
|
||||||
|
+ eng->maxWidth = QFIXED_MAX;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
line.textWidth += trailingSpace;
|
||||||
|
if (lbh.spaceData.length) {
|
||||||
@ -0,0 +1,97 @@
|
|||||||
|
From 2103f2487f709dd9546c503820d9ad509e9a63b3 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Thiago Macieira <thiago.macieira@intel.com>
|
||||||
|
Date: Thu, 11 May 2023 21:40:15 -0700
|
||||||
|
Subject: QDnsLookup/Unix: make sure we don't overflow the buffer
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
The DNS Records are variable length and encode their size in 16 bits
|
||||||
|
before the Record Data (RDATA). Ensure that both the RDATA and the
|
||||||
|
Record header fields before it fall inside the buffer we have.
|
||||||
|
|
||||||
|
Additionally reject any replies containing more than one query records.
|
||||||
|
|
||||||
|
[ChangeLog][QtNetwork][QDnsLookup] Fixed a bug that could cause a buffer
|
||||||
|
overflow in Unix systems while parsing corrupt, malicious, or truncated
|
||||||
|
replies.
|
||||||
|
|
||||||
|
Pick-to: 5.15 6.2 6.5 6.5.1
|
||||||
|
Change-Id: I3e3bfef633af4130a03afffd175e4b9547654b95
|
||||||
|
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>
|
||||||
|
Reviewed-by: Jani Heikkinen <jani.heikkinen@qt.io>
|
||||||
|
(cherry picked from commit 7dba2c87619d558a61a30eb30cc1d9c3fe6df94c)
|
||||||
|
|
||||||
|
* asturmlechner 2023-05-18: Resolve conflict with dev branch commit
|
||||||
|
68b625901f9eb7c34e3d7aa302e1c0a454d3190b
|
||||||
|
|
||||||
|
diff --git a/src/network/kernel/qdnslookup_unix.cpp b/src/network/kernel/qdnslookup_unix.cpp
|
||||||
|
index 12b40fc35d..99e999d436 100644
|
||||||
|
--- a/src/network/kernel/qdnslookup_unix.cpp
|
||||||
|
+++ b/src/network/kernel/qdnslookup_unix.cpp
|
||||||
|
@@ -227,7 +227,6 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
|
||||||
|
// responseLength in case of error, we still can extract the
|
||||||
|
// exact error code from the response.
|
||||||
|
HEADER *header = (HEADER*)response;
|
||||||
|
- const int answerCount = ntohs(header->ancount);
|
||||||
|
switch (header->rcode) {
|
||||||
|
case NOERROR:
|
||||||
|
break;
|
||||||
|
@@ -260,18 +259,31 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
- // Skip the query host, type (2 bytes) and class (2 bytes).
|
||||||
|
char host[PACKETSZ], answer[PACKETSZ];
|
||||||
|
unsigned char *p = response + sizeof(HEADER);
|
||||||
|
- int status = local_dn_expand(response, response + responseLength, p, host, sizeof(host));
|
||||||
|
- if (status < 0) {
|
||||||
|
+ int status;
|
||||||
|
+
|
||||||
|
+ if (ntohs(header->qdcount) == 1) {
|
||||||
|
+ // Skip the query host, type (2 bytes) and class (2 bytes).
|
||||||
|
+ status = local_dn_expand(response, response + responseLength, p, host, sizeof(host));
|
||||||
|
+ if (status < 0) {
|
||||||
|
+ reply->error = QDnsLookup::InvalidReplyError;
|
||||||
|
+ reply->errorString = tr("Could not expand domain name");
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+ if ((p - response) + status + 4 >= responseLength)
|
||||||
|
+ header->qdcount = 0xffff; // invalid reply below
|
||||||
|
+ else
|
||||||
|
+ p += status + 4;
|
||||||
|
+ }
|
||||||
|
+ if (ntohs(header->qdcount) > 1) {
|
||||||
|
reply->error = QDnsLookup::InvalidReplyError;
|
||||||
|
- reply->errorString = tr("Could not expand domain name");
|
||||||
|
+ reply->errorString = tr("Invalid reply received");
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
- p += status + 4;
|
||||||
|
|
||||||
|
// Extract results.
|
||||||
|
+ const int answerCount = ntohs(header->ancount);
|
||||||
|
int answerIndex = 0;
|
||||||
|
while ((p < response + responseLength) && (answerIndex < answerCount)) {
|
||||||
|
status = local_dn_expand(response, response + responseLength, p, host, sizeof(host));
|
||||||
|
@@ -283,6 +295,11 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
|
||||||
|
const QString name = QUrl::fromAce(host);
|
||||||
|
|
||||||
|
p += status;
|
||||||
|
+
|
||||||
|
+ if ((p - response) + 10 > responseLength) {
|
||||||
|
+ // probably just a truncated reply, return what we have
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
const quint16 type = (p[0] << 8) | p[1];
|
||||||
|
p += 2; // RR type
|
||||||
|
p += 2; // RR class
|
||||||
|
@@ -290,6 +307,8 @@ void QDnsLookupRunnable::query(const int requestType, const QByteArray &requestN
|
||||||
|
p += 4;
|
||||||
|
const quint16 size = (p[0] << 8) | p[1];
|
||||||
|
p += 2;
|
||||||
|
+ if ((p - response) + size > responseLength)
|
||||||
|
+ return; // truncated
|
||||||
|
|
||||||
|
if (type == QDnsLookup::A) {
|
||||||
|
if (size != 4) {
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
--- a/src/network/ssl/qsslsocket_schannel.cpp
|
||||||
|
+++ b/src/network/ssl/qsslsocket_schannel.cpp
|
||||||
|
@@ -1880,6 +1880,28 @@ bool QSslSocketBackendPrivate::verifyCertContext(CERT_CONTEXT *certContext)
|
||||||
|
if (configuration.peerVerifyDepth > 0 && DWORD(configuration.peerVerifyDepth) < verifyDepth)
|
||||||
|
verifyDepth = DWORD(configuration.peerVerifyDepth);
|
||||||
|
|
||||||
|
+ const auto &caCertificates = q->sslConfiguration().caCertificates();
|
||||||
|
+
|
||||||
|
+ if (!rootCertOnDemandLoadingAllowed()
|
||||||
|
+ && !(chain->TrustStatus.dwErrorStatus & CERT_TRUST_IS_PARTIAL_CHAIN)
|
||||||
|
+ && (q->peerVerifyMode() == QSslSocket::VerifyPeer
|
||||||
|
+ || (isClient && q->peerVerifyMode() == QSslSocket::AutoVerifyPeer))) {
|
||||||
|
+ // When verifying a peer Windows "helpfully" builds a chain that
|
||||||
|
+ // may include roots from the system store. But we don't want that if
|
||||||
|
+ // the user has set their own CA certificates.
|
||||||
|
+ // Since Windows claims this is not a partial chain the root is included
|
||||||
|
+ // and we have to check that it is one of our configured CAs.
|
||||||
|
+ CERT_CHAIN_ELEMENT *element = chain->rgpElement[chain->cElement - 1];
|
||||||
|
+ QSslCertificate certificate = getCertificateFromChainElement(element);
|
||||||
|
+ if (!caCertificates.contains(certificate)) {
|
||||||
|
+ auto error = QSslError(QSslError::CertificateUntrusted, certificate);
|
||||||
|
+ sslErrors += error;
|
||||||
|
+ emit q->peerVerifyError(error);
|
||||||
|
+ if (q->state() != QAbstractSocket::ConnectedState)
|
||||||
|
+ return false;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
for (DWORD i = 0; i < verifyDepth; i++) {
|
||||||
|
CERT_CHAIN_ELEMENT *element = chain->rgpElement[i];
|
||||||
|
QSslCertificate certificate = getCertificateFromChainElement(element);
|
||||||
|
|
||||||
|
|
||||||
|
--- a/src/network/ssl/qsslsocket.cpp
|
||||||
|
+++ b/src/network/ssl/qsslsocket.cpp
|
||||||
|
@@ -2221,6 +2221,10 @@ QSslSocketPrivate::QSslSocketPrivate()
|
||||||
|
, flushTriggered(false)
|
||||||
|
{
|
||||||
|
QSslConfigurationPrivate::deepCopyDefaultConfiguration(&configuration);
|
||||||
|
+ // If the global configuration doesn't allow root certificates to be loaded
|
||||||
|
+ // on demand then we have to disable it for this socket as well.
|
||||||
|
+ if (!configuration.allowRootCertOnDemandLoading)
|
||||||
|
+ allowRootCertOnDemandLoading = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*!
|
||||||
|
@@ -2470,6 +2474,7 @@ void QSslConfigurationPrivate::deepCopyDefaultConfiguration(QSslConfigurationPri
|
||||||
|
ptr->sessionProtocol = global->sessionProtocol;
|
||||||
|
ptr->ciphers = global->ciphers;
|
||||||
|
ptr->caCertificates = global->caCertificates;
|
||||||
|
+ ptr->allowRootCertOnDemandLoading = global->allowRootCertOnDemandLoading;
|
||||||
|
ptr->protocol = global->protocol;
|
||||||
|
ptr->peerVerifyMode = global->peerVerifyMode;
|
||||||
|
ptr->peerVerifyDepth = global->peerVerifyDepth;
|
||||||
@ -0,0 +1,202 @@
|
|||||||
|
diff --git a/src/corelib/serialization/qxmlstream.cpp b/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
index 4f282f19..6c98e7c0 100644
|
||||||
|
--- a/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
+++ b/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
@@ -1302,11 +1302,19 @@ inline int QXmlStreamReaderPrivate::fastScanContentCharList()
|
||||||
|
return n;
|
||||||
|
}
|
||||||
|
|
||||||
|
-inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
|
||||||
|
+// Fast scan an XML attribute name (e.g. "xml:lang").
|
||||||
|
+inline QXmlStreamReaderPrivate::FastScanNameResult
|
||||||
|
+QXmlStreamReaderPrivate::fastScanName(Value *val)
|
||||||
|
{
|
||||||
|
int n = 0;
|
||||||
|
uint c;
|
||||||
|
while ((c = getChar()) != StreamEOF) {
|
||||||
|
+ if (n >= 4096) {
|
||||||
|
+ // This is too long to be a sensible name, and
|
||||||
|
+ // can exhaust memory, or the range of decltype(*prefix)
|
||||||
|
+ raiseNamePrefixTooLongError();
|
||||||
|
+ return {};
|
||||||
|
+ }
|
||||||
|
switch (c) {
|
||||||
|
case '\n':
|
||||||
|
case ' ':
|
||||||
|
@@ -1334,23 +1342,23 @@ inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
|
||||||
|
case '+':
|
||||||
|
case '*':
|
||||||
|
putChar(c);
|
||||||
|
- if (prefix && *prefix == n+1) {
|
||||||
|
- *prefix = 0;
|
||||||
|
+ if (val && val->prefix == n + 1) {
|
||||||
|
+ val->prefix = 0;
|
||||||
|
putChar(':');
|
||||||
|
--n;
|
||||||
|
}
|
||||||
|
- return n;
|
||||||
|
+ return FastScanNameResult(n);
|
||||||
|
case ':':
|
||||||
|
- if (prefix) {
|
||||||
|
- if (*prefix == 0) {
|
||||||
|
- *prefix = n+2;
|
||||||
|
+ if (val) {
|
||||||
|
+ if (val->prefix == 0) {
|
||||||
|
+ val->prefix = n + 2;
|
||||||
|
} else { // only one colon allowed according to the namespace spec.
|
||||||
|
putChar(c);
|
||||||
|
- return n;
|
||||||
|
+ return FastScanNameResult(n);
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
putChar(c);
|
||||||
|
- return n;
|
||||||
|
+ return FastScanNameResult(n);
|
||||||
|
}
|
||||||
|
Q_FALLTHROUGH();
|
||||||
|
default:
|
||||||
|
@@ -1359,12 +1367,12 @@ inline int QXmlStreamReaderPrivate::fastScanName(int *prefix)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (prefix)
|
||||||
|
- *prefix = 0;
|
||||||
|
+ if (val)
|
||||||
|
+ val->prefix = 0;
|
||||||
|
int pos = textBuffer.size() - n;
|
||||||
|
putString(textBuffer, pos);
|
||||||
|
textBuffer.resize(pos);
|
||||||
|
- return 0;
|
||||||
|
+ return FastScanNameResult(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
enum NameChar { NameBeginning, NameNotBeginning, NotName };
|
||||||
|
@@ -1873,6 +1881,14 @@ void QXmlStreamReaderPrivate::raiseWellFormedError(const QString &message)
|
||||||
|
raiseError(QXmlStreamReader::NotWellFormedError, message);
|
||||||
|
}
|
||||||
|
|
||||||
|
+void QXmlStreamReaderPrivate::raiseNamePrefixTooLongError()
|
||||||
|
+{
|
||||||
|
+ // TODO: add a ImplementationLimitsExceededError and use it instead
|
||||||
|
+ raiseError(QXmlStreamReader::NotWellFormedError,
|
||||||
|
+ QXmlStream::tr("Length of XML attribute name exceeds implemnetation limits (4KiB "
|
||||||
|
+ "characters)."));
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
void QXmlStreamReaderPrivate::parseError()
|
||||||
|
{
|
||||||
|
|
||||||
|
diff --git a/src/corelib/serialization/qxmlstream.g b/src/corelib/serialization/qxmlstream.g
|
||||||
|
index b623de95..e4310285 100644
|
||||||
|
--- a/src/corelib/serialization/qxmlstream.g
|
||||||
|
+++ b/src/corelib/serialization/qxmlstream.g
|
||||||
|
@@ -516,7 +516,16 @@ public:
|
||||||
|
int fastScanLiteralContent();
|
||||||
|
int fastScanSpace();
|
||||||
|
int fastScanContentCharList();
|
||||||
|
- int fastScanName(int *prefix = nullptr);
|
||||||
|
+
|
||||||
|
+ struct FastScanNameResult {
|
||||||
|
+ FastScanNameResult() : ok(false) {}
|
||||||
|
+ explicit FastScanNameResult(int len) : addToLen(len), ok(true) { }
|
||||||
|
+ operator bool() { return ok; }
|
||||||
|
+ int operator*() { Q_ASSERT(ok); return addToLen; }
|
||||||
|
+ int addToLen;
|
||||||
|
+ bool ok;
|
||||||
|
+ };
|
||||||
|
+ FastScanNameResult fastScanName(Value *val = nullptr);
|
||||||
|
inline int fastScanNMTOKEN();
|
||||||
|
|
||||||
|
|
||||||
|
@@ -525,6 +534,7 @@ public:
|
||||||
|
|
||||||
|
void raiseError(QXmlStreamReader::Error error, const QString& message = QString());
|
||||||
|
void raiseWellFormedError(const QString &message);
|
||||||
|
+ void raiseNamePrefixTooLongError();
|
||||||
|
|
||||||
|
QXmlStreamEntityResolver *entityResolver;
|
||||||
|
|
||||||
|
@@ -1809,7 +1819,12 @@ space_opt ::= space;
|
||||||
|
qname ::= LETTER;
|
||||||
|
/.
|
||||||
|
case $rule_number: {
|
||||||
|
- sym(1).len += fastScanName(&sym(1).prefix);
|
||||||
|
+ Value &val = sym(1);
|
||||||
|
+ if (auto res = fastScanName(&val))
|
||||||
|
+ val.len += *res;
|
||||||
|
+ else
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
if (atEnd) {
|
||||||
|
resume($rule_number);
|
||||||
|
return false;
|
||||||
|
@@ -1820,7 +1835,11 @@ qname ::= LETTER;
|
||||||
|
name ::= LETTER;
|
||||||
|
/.
|
||||||
|
case $rule_number:
|
||||||
|
- sym(1).len += fastScanName();
|
||||||
|
+ if (auto res = fastScanName())
|
||||||
|
+ sym(1).len += *res;
|
||||||
|
+ else
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
if (atEnd) {
|
||||||
|
resume($rule_number);
|
||||||
|
return false;
|
||||||
|
diff --git a/src/corelib/serialization/qxmlstream_p.h b/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
index 103b123b..80e7f740 100644
|
||||||
|
--- a/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
+++ b/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
@@ -1005,7 +1005,16 @@ public:
|
||||||
|
int fastScanLiteralContent();
|
||||||
|
int fastScanSpace();
|
||||||
|
int fastScanContentCharList();
|
||||||
|
- int fastScanName(int *prefix = nullptr);
|
||||||
|
+
|
||||||
|
+ struct FastScanNameResult {
|
||||||
|
+ FastScanNameResult() : ok(false) {}
|
||||||
|
+ explicit FastScanNameResult(int len) : addToLen(len), ok(true) { }
|
||||||
|
+ operator bool() { return ok; }
|
||||||
|
+ int operator*() { Q_ASSERT(ok); return addToLen; }
|
||||||
|
+ int addToLen;
|
||||||
|
+ bool ok;
|
||||||
|
+ };
|
||||||
|
+ FastScanNameResult fastScanName(Value *val = nullptr);
|
||||||
|
inline int fastScanNMTOKEN();
|
||||||
|
|
||||||
|
|
||||||
|
@@ -1014,6 +1023,7 @@ public:
|
||||||
|
|
||||||
|
void raiseError(QXmlStreamReader::Error error, const QString& message = QString());
|
||||||
|
void raiseWellFormedError(const QString &message);
|
||||||
|
+ void raiseNamePrefixTooLongError();
|
||||||
|
|
||||||
|
QXmlStreamEntityResolver *entityResolver;
|
||||||
|
|
||||||
|
@@ -1937,7 +1947,12 @@ bool QXmlStreamReaderPrivate::parse()
|
||||||
|
break;
|
||||||
|
|
||||||
|
case 262: {
|
||||||
|
- sym(1).len += fastScanName(&sym(1).prefix);
|
||||||
|
+ Value &val = sym(1);
|
||||||
|
+ if (auto res = fastScanName(&val))
|
||||||
|
+ val.len += *res;
|
||||||
|
+ else
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
if (atEnd) {
|
||||||
|
resume(262);
|
||||||
|
return false;
|
||||||
|
@@ -1945,7 +1960,11 @@ bool QXmlStreamReaderPrivate::parse()
|
||||||
|
} break;
|
||||||
|
|
||||||
|
case 263:
|
||||||
|
- sym(1).len += fastScanName();
|
||||||
|
+ if (auto res = fastScanName())
|
||||||
|
+ sym(1).len += *res;
|
||||||
|
+ else
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
if (atEnd) {
|
||||||
|
resume(263);
|
||||||
|
return false;
|
||||||
@ -0,0 +1,219 @@
|
|||||||
|
diff --git a/src/corelib/serialization/qxmlstream.cpp b/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
index bf8a2a9..6ab5d49 100644
|
||||||
|
--- a/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
+++ b/src/corelib/serialization/qxmlstream.cpp
|
||||||
|
@@ -160,7 +160,7 @@
|
||||||
|
addData() or by waiting for it to arrive on the device().
|
||||||
|
|
||||||
|
\value UnexpectedElementError The parser encountered an element
|
||||||
|
- that was different to those it expected.
|
||||||
|
+ or token that was different to those it expected.
|
||||||
|
|
||||||
|
*/
|
||||||
|
|
||||||
|
@@ -295,13 +295,34 @@
|
||||||
|
|
||||||
|
QXmlStreamReader is a well-formed XML 1.0 parser that does \e not
|
||||||
|
include external parsed entities. As long as no error occurs, the
|
||||||
|
- application code can thus be assured that the data provided by the
|
||||||
|
- stream reader satisfies the W3C's criteria for well-formed XML. For
|
||||||
|
- example, you can be certain that all tags are indeed nested and
|
||||||
|
- closed properly, that references to internal entities have been
|
||||||
|
- replaced with the correct replacement text, and that attributes have
|
||||||
|
- been normalized or added according to the internal subset of the
|
||||||
|
- DTD.
|
||||||
|
+ application code can thus be assured, that
|
||||||
|
+ \list
|
||||||
|
+ \li the data provided by the stream reader satisfies the W3C's
|
||||||
|
+ criteria for well-formed XML,
|
||||||
|
+ \li tokens are provided in a valid order.
|
||||||
|
+ \endlist
|
||||||
|
+
|
||||||
|
+ Unless QXmlStreamReader raises an error, it guarantees the following:
|
||||||
|
+ \list
|
||||||
|
+ \li All tags are nested and closed properly.
|
||||||
|
+ \li References to internal entities have been replaced with the
|
||||||
|
+ correct replacement text.
|
||||||
|
+ \li Attributes have been normalized or added according to the
|
||||||
|
+ internal subset of the \l DTD.
|
||||||
|
+ \li Tokens of type \l StartDocument happen before all others,
|
||||||
|
+ aside from comments and processing instructions.
|
||||||
|
+ \li At most one DOCTYPE element (a token of type \l DTD) is present.
|
||||||
|
+ \li If present, the DOCTYPE appears before all other elements,
|
||||||
|
+ aside from StartDocument, comments and processing instructions.
|
||||||
|
+ \endlist
|
||||||
|
+
|
||||||
|
+ In particular, once any token of type \l StartElement, \l EndElement,
|
||||||
|
+ \l Characters, \l EntityReference or \l EndDocument is seen, no
|
||||||
|
+ tokens of type StartDocument or DTD will be seen. If one is present in
|
||||||
|
+ the input stream, out of order, an error is raised.
|
||||||
|
+
|
||||||
|
+ \note The token types \l Comment and \l ProcessingInstruction may appear
|
||||||
|
+ anywhere in the stream.
|
||||||
|
|
||||||
|
If an error occurs while parsing, atEnd() and hasError() return
|
||||||
|
true, and error() returns the error that occurred. The functions
|
||||||
|
@@ -620,6 +641,7 @@
|
||||||
|
d->token = -1;
|
||||||
|
return readNext();
|
||||||
|
}
|
||||||
|
+ d->checkToken();
|
||||||
|
return d->type;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -740,6 +762,14 @@
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
+static const char QXmlStreamReader_XmlContextString[] =
|
||||||
|
+ "Prolog\0"
|
||||||
|
+ "Body\0";
|
||||||
|
+
|
||||||
|
+static const short QXmlStreamReader_XmlContextString_indices[] = {
|
||||||
|
+ 0, 7
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
/*!
|
||||||
|
\property QXmlStreamReader::namespaceProcessing
|
||||||
|
The namespace-processing flag of the stream reader
|
||||||
|
@@ -775,6 +805,16 @@
|
||||||
|
QXmlStreamReader_tokenTypeString_indices[d->type]);
|
||||||
|
}
|
||||||
|
|
||||||
|
+/*!
|
||||||
|
+ \internal
|
||||||
|
+ \return \param ctxt (Prolog/Body) as a string.
|
||||||
|
+ */
|
||||||
|
+QString contextString(QXmlStreamReaderPrivate::XmlContext ctxt)
|
||||||
|
+{
|
||||||
|
+ return QLatin1String(QXmlStreamReader_XmlContextString +
|
||||||
|
+ QXmlStreamReader_XmlContextString_indices[static_cast<int>(ctxt)]);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
#endif // QT_NO_XMLSTREAMREADER
|
||||||
|
|
||||||
|
QXmlStreamPrivateTagStack::QXmlStreamPrivateTagStack()
|
||||||
|
@@ -866,6 +906,8 @@
|
||||||
|
|
||||||
|
type = QXmlStreamReader::NoToken;
|
||||||
|
error = QXmlStreamReader::NoError;
|
||||||
|
+ currentContext = XmlContext::Prolog;
|
||||||
|
+ foundDTD = false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -4061,6 +4103,92 @@
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+static bool isTokenAllowedInContext(QXmlStreamReader::TokenType type,
|
||||||
|
+ QXmlStreamReaderPrivate::XmlContext loc)
|
||||||
|
+{
|
||||||
|
+ switch (type) {
|
||||||
|
+ case QXmlStreamReader::StartDocument:
|
||||||
|
+ case QXmlStreamReader::DTD:
|
||||||
|
+ return loc == QXmlStreamReaderPrivate::XmlContext::Prolog;
|
||||||
|
+
|
||||||
|
+ case QXmlStreamReader::StartElement:
|
||||||
|
+ case QXmlStreamReader::EndElement:
|
||||||
|
+ case QXmlStreamReader::Characters:
|
||||||
|
+ case QXmlStreamReader::EntityReference:
|
||||||
|
+ case QXmlStreamReader::EndDocument:
|
||||||
|
+ return loc == QXmlStreamReaderPrivate::XmlContext::Body;
|
||||||
|
+
|
||||||
|
+ case QXmlStreamReader::Comment:
|
||||||
|
+ case QXmlStreamReader::ProcessingInstruction:
|
||||||
|
+ return true;
|
||||||
|
+
|
||||||
|
+ case QXmlStreamReader::NoToken:
|
||||||
|
+ case QXmlStreamReader::Invalid:
|
||||||
|
+ return false;
|
||||||
|
+ default:
|
||||||
|
+ return false;
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*!
|
||||||
|
+ \internal
|
||||||
|
+ \brief QXmlStreamReader::isValidToken
|
||||||
|
+ \return \c true if \param type is a valid token type.
|
||||||
|
+ \return \c false if \param type is an unexpected token,
|
||||||
|
+ which indicates a non-well-formed or invalid XML stream.
|
||||||
|
+ */
|
||||||
|
+bool QXmlStreamReaderPrivate::isValidToken(QXmlStreamReader::TokenType type)
|
||||||
|
+{
|
||||||
|
+ // Don't change currentContext, if Invalid or NoToken occur in the prolog
|
||||||
|
+ if (type == QXmlStreamReader::Invalid || type == QXmlStreamReader::NoToken)
|
||||||
|
+ return false;
|
||||||
|
+
|
||||||
|
+ // If a token type gets rejected in the body, there is no recovery
|
||||||
|
+ const bool result = isTokenAllowedInContext(type, currentContext);
|
||||||
|
+ if (result || currentContext == XmlContext::Body)
|
||||||
|
+ return result;
|
||||||
|
+
|
||||||
|
+ // First non-Prolog token observed => switch context to body and check again.
|
||||||
|
+ currentContext = XmlContext::Body;
|
||||||
|
+ return isTokenAllowedInContext(type, currentContext);
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+/*!
|
||||||
|
+ \internal
|
||||||
|
+ Checks token type and raises an error, if it is invalid
|
||||||
|
+ in the current context (prolog/body).
|
||||||
|
+ */
|
||||||
|
+void QXmlStreamReaderPrivate::checkToken()
|
||||||
|
+{
|
||||||
|
+ Q_Q(QXmlStreamReader);
|
||||||
|
+
|
||||||
|
+ // The token type must be consumed, to keep track if the body has been reached.
|
||||||
|
+ const XmlContext context = currentContext;
|
||||||
|
+ const bool ok = isValidToken(type);
|
||||||
|
+
|
||||||
|
+ // Do nothing if an error has been raised already (going along with an unexpected token)
|
||||||
|
+ if (error != QXmlStreamReader::Error::NoError)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ if (!ok) {
|
||||||
|
+ raiseError(QXmlStreamReader::UnexpectedElementError,
|
||||||
|
+ QLatin1String("Unexpected token type %1 in %2.")
|
||||||
|
+ .arg(q->tokenString(), contextString(context)));
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (type != QXmlStreamReader::DTD)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
+ // Raise error on multiple DTD tokens
|
||||||
|
+ if (foundDTD) {
|
||||||
|
+ raiseError(QXmlStreamReader::UnexpectedElementError,
|
||||||
|
+ QLatin1String("Found second DTD token in %1.").arg(contextString(context)));
|
||||||
|
+ } else {
|
||||||
|
+ foundDTD = true;
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
/*!
|
||||||
|
\fn bool QXmlStreamAttributes::hasAttribute(const QString &qualifiedName) const
|
||||||
|
\since 4.5
|
||||||
|
diff --git a/src/corelib/serialization/qxmlstream_p.h b/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
index 8f7c9e0..708059b 100644
|
||||||
|
--- a/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
+++ b/src/corelib/serialization/qxmlstream_p.h
|
||||||
|
@@ -804,6 +804,17 @@
|
||||||
|
#endif
|
||||||
|
bool atEnd;
|
||||||
|
|
||||||
|
+ enum class XmlContext
|
||||||
|
+ {
|
||||||
|
+ Prolog,
|
||||||
|
+ Body,
|
||||||
|
+ };
|
||||||
|
+
|
||||||
|
+ XmlContext currentContext = XmlContext::Prolog;
|
||||||
|
+ bool foundDTD = false;
|
||||||
|
+ bool isValidToken(QXmlStreamReader::TokenType type);
|
||||||
|
+ void checkToken();
|
||||||
|
+
|
||||||
|
/*!
|
||||||
|
\sa setType()
|
||||||
|
*/
|
||||||
Loading…
Reference in new issue