fix possible heap corruption in QXmlStream

upstream commit:
https://github.com/qt/qtbase/commit/6256729a6da532079505edfe4c56a6ef29cd8ab8

Signed-off-by: Ivailo Monev <xakepa10@gmail.com>

diff --git a/src/xml/kernel/qxmlstream.g b/src/xml/kernel/qxmlstream.g
index 7d79c03..7239004 100644 (file)
--- a/src/xml/kernel/qxmlstream.g
+++ b/src/xml/kernel/qxmlstream.g
@@ -738,7 +738,7 @@ bool QXmlStreamReaderPrivate::parse()
             state_stack[tos] = 0;
             return true;
         } else if (act > 0) {
-            if (++tos == stack_size-1)
+            if (++tos >= stack_size-1)
                 reallocateStack();
 
             Value &val = sym_stack[tos];

diff --git a/src/xml/kernel/qxmlstream_p.h b/src/xml/kernel/qxmlstream_p.h
index 55ce3a3..773f3e9 100644 (file)
--- a/src/xml/kernel/qxmlstream_p.h
+++ b/src/xml/kernel/qxmlstream_p.h
@@ -1220,7 +1220,7 @@ bool QXmlStreamReaderPrivate::parse()
             state_stack[tos] = 0;
             return true;
         } else if (act > 0) {
-            if (++tos == stack_size-1)
+            if (++tos >= stack_size-1)
                 reallocateStack();
 
             Value &val = sym_stack[tos];