From 7743b020c54b4ac7152be1305ad61c6a8fdc604d Mon Sep 17 00:00:00 2001 From: peijiankang Date: Wed, 31 Jan 2024 13:43:57 +0800 Subject: [PATCH] qtbase5.11.1-CVE-2023-51714 --- src/network/access/http2/hpacktable.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/network/access/http2/hpacktable.cpp b/src/network/access/http2/hpacktable.cpp index a90ee72d..4f452ad0 100644 --- a/src/network/access/http2/hpacktable.cpp +++ b/src/network/access/http2/hpacktable.cpp @@ -40,6 +40,7 @@ #include "hpacktable_p.h" #include +#include #include #include @@ -60,9 +61,10 @@ HeaderSize entry_size(const QByteArray &name, const QByteArray &value) // to reference the name and the value of the entry and two 64-bit integers // for counting the number of references to the name and value would have // 32 octets of overhead." - - const unsigned sum = unsigned(name.size()) + value.size(); - if (std::numeric_limits::max() - 32 < sum) + size_t sum; + if (add_overflow(size_t(name.size()), size_t(value.size()), &sum)) + return HeaderSize(); + if (sum > (std::numeric_limits::max() - 32)) return HeaderSize(); return HeaderSize(true, quint32(sum + 32)); } -- 2.41.0