Changeset 27deb31 in subsurface


Ignore:
Timestamp:
Jun 15, 2017, 2:48:49 PM (3 months ago)
Author:
Dirk Hohndel <dirk@…>
Branches:
master
Children:
77a3e6a
Parents:
85021b9
git-author:
Lubomir I. Ivanov <neolit123@…> (06/13/17 15:45:18)
git-committer:
Dirk Hohndel <dirk@…> (06/15/17 14:48:49)
Message:

tankinfomodel.cpp: clamp row index to [0 - MAX_TANK_INFO]

MAX_TANK_INFO is a new macro in dive.h to define the
maximum number of tank_info_t objects.

TankInfoModel?'s data() and setData() now check for valid
row indexes before accessing the tank_info[] array directly.

Without this patch TankInfoMode::data() can cause a SIGSEGV.

Reported-by: Pedro Neves <nevesdiver@…>
Signed-off-by: Lubomir I. Ivanov <neolit123@…>
Signed-off-by: Dirk Hohndel <dirk@…>

Files:
2 edited

Legend:

Unmodified
Added
Removed
  • core/dive.h

    rdec47e1 r27deb31  
    297297#define MAX_CYLINDERS (20)
    298298#define MAX_WEIGHTSYSTEMS (6)
     299#define MAX_TANK_INFO (100)
    299300#define W_IDX_PRIMARY 0
    300301#define W_IDX_SECONDARY 1
     
    924925        int cuft, ml, psi, bar;
    925926};
    926 extern struct tank_info_t tank_info[100];
     927extern struct tank_info_t tank_info[MAX_TANK_INFO];
    927928
    928929struct ws_info_t {
  • qt-models/tankinfomodel.cpp

    r5372f12 r27deb31  
    2929        //WARN Seems wrong, we need to check for role == Qt::EditRole
    3030        Q_UNUSED(role);
     31
     32        if (index.row() < 0 || index.row() > MAX_TANK_INFO - 1)
     33                return false;
     34
    3135        struct tank_info_t *info = &tank_info[index.row()];
    3236        switch (index.column()) {
     
    5256{
    5357        QVariant ret;
    54         if (!index.isValid()) {
     58        if (!index.isValid() || index.row() < 0 || index.row() > MAX_TANK_INFO - 1) {
    5559                return ret;
    5660        }
Note: See TracChangeset for help on using the changeset viewer.