QQmlDMListAccessorData: fix potentially non-null-terminated string use

In toUtf8(), the QString branch and the const char* branch create
QByteArrays that are(!) guaranteed to be null-terminated, if only by
happening to have a NUL byte following the [data(), size()[ block (in
the fromRawData() case). The branch that doesn't guarantee this is the
QByteArray one, which just returns the QBA passed in unchanged.

Be more robust by ensuring null termination with a call to
nullTerminated().

Then make the conversion from QByteArray to const char* explicit, so
the code is compatible with QT_NO_CAST_FROM_BYTEARRAY, which is how
this was found in the first place.

Amends 0f139dfbfceab7e5ddbb7ef79c6fb83c989ed90a (6.6).

QByteArray::nullTerminated() is new in Qt 6.10. For 6.8, we'll need to
find a replacement (e.g. detach()).

Pick-to: 6.8
Task-number: QTBUG-145829
Change-Id: Ib185970cf9a0a841cdc2635fd51b6e312e87fe2b
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>
(cherry picked from commit 4496f7940c3ba5141d26f6837032328d0a116172)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

1 files changed, 6 insertions, 6 deletions

diff --git a/src/qmlmodels/qqmldmlistaccessordata_p.h b/src/qmlmodels/qqmldmlistaccessordata_p.h
index 29fe556754..7f98a88af5 100644
--- a/src/qmlmodels/qqmldmlistaccessordata_p.h
+++ b/src/qmlmodels/qqmldmlistaccessordata_p.h
@@ -166,7 +166,7 @@ public:
         if constexpr (std::is_same_v<String, QString>)
             return string.toUtf8();
         else if constexpr (std::is_same_v<String, QByteArray>)
-            return string;
+            return string.nullTerminated();
         else if constexpr (std::is_same_v<String, const char *>)
             return QByteArray::fromRawData(string, qstrlen(string));
         else
@@ -185,10 +185,10 @@ public:
 
         const QMetaType::TypeFlags typeFlags = type.flags();
         if (typeFlags & QMetaType::PointerToQObject)
-            return row->value<QObject *>()->property(toUtf8(role));
+            return row->value<QObject *>()->property(toUtf8(role).constData());
 
         if (const QMetaObject *metaObject = metaObjectFromType(type)) {
-            const int propertyIndex = metaObject->indexOfProperty(toUtf8(role));
+            const int propertyIndex = metaObject->indexOfProperty(toUtf8(role).constData());
             if (propertyIndex >= 0)
                 return metaObject->property(propertyIndex).readOnGadget(row->constData());
         }
@@ -204,7 +204,7 @@ public:
                 return;
         }
 
-        createProperty(toUtf8(string), nullptr);
+        createProperty(toUtf8(string).constData(), nullptr);
     }
 
     void createMissingProperties(const QVariant *row)
@@ -237,9 +237,9 @@ public:
         } else if (type == QMetaType::fromType<QVariantHash>()) {
             static_cast<QVariantHash *>(row->data())->insert(toQString(role), value);
         } else if (type.flags() & QMetaType::PointerToQObject) {
-            row->value<QObject *>()->setProperty(toUtf8(role), value);
+            row->value<QObject *>()->setProperty(toUtf8(role).constData(), value);
         } else if (const QMetaObject *metaObject = metaObjectFromType(type)) {
-            const int propertyIndex = metaObject->indexOfProperty(toUtf8(role));
+            const int propertyIndex = metaObject->indexOfProperty(toUtf8(role).constData());
             if (propertyIndex >= 0)
                 metaObject->property(propertyIndex).writeOnGadget(row->data(), value);
         }