qiurui
/
qtgrpc
mirror of https://github.com/qt/qtgrpc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ProtobufSerializer: fix potential overflow in encodeHeader 

Ensure the fieldNumber remains within valid bounds before shifting.
Replace implicit conversions with explicit uint* casts.

Coverity-Id: 479441
Pick-to: 6.9 6.8
Change-Id: I82f9436f7fe89feab2fd60ff982c96631e390514
Reviewed-by: Alexey Edelev <alexey.edelev@qt.io>
This commit is contained in:
Dennis Oberst 2025-04-04 13:21:56 +02:00
parent 4b536e162d
commit 4de7b5f2b5
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/protobuf/qprotobufserializer.cpp
View File

@ -283,8 +283,11 @@ QByteArray QProtobufSerializerImpl::encodeHeader(int fieldNumber, QtProtobuf::Wi
// wireType: Serialization type used for the property with fieldNumber
// Returns a varint-encoded fieldIndex and wireType
uint32_t header = (fieldNumber << 3) | int(wireType);
[[maybe_unused]] static constexpr int32_t MaxFieldNumber =
std::numeric_limits<uint32_t>::max() >> 3u;
Q_ASSERT(fieldNumber >= 1 && fieldNumber <= MaxFieldNumber
&& (fieldNumber < 19000 || fieldNumber > 19999));
uint32_t header = (uint(fieldNumber) << 3u) | uint32_t(wireType);
return serializeVarintCommon<uint32_t>(header);
}