From 18353901a2215376e2f0274a408ce2213c180f16 Mon Sep 17 00:00:00 2001
From: Linus Jahn <lnj@kaidan.im>
Date: Thu, 9 Mar 2023 17:36:17 +0100
Subject: SaslDigestMd5: Fix UB when at the end of input byte array [Qt6 only]

Also adds a unit test.

Fixes #541.
---
 src/base/QXmppSasl.cpp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

(limited to 'src/base/QXmppSasl.cpp')

diff --git a/src/base/QXmppSasl.cpp b/src/base/QXmppSasl.cpp
index d8a86bb0..86e67b01 100644
--- a/src/base/QXmppSasl.cpp
+++ b/src/base/QXmppSasl.cpp
@@ -896,8 +896,12 @@ QMap<QByteArray, QByteArray> QXmppSaslDigestMd5::parseMessage(const QByteArray &
         const QByteArray key = ba.mid(startIndex, pos - startIndex).trimmed();
         pos++;
 
-        // check whether string is quoted
-        if (ba.at(pos) == '"') {
+        if (pos == ba.size()) {
+            // end of the input
+            map.insert(key, QByteArray());
+            startIndex = pos;
+        } else if (ba.at(pos) == '"') {
+            // check whether string is quoted
             // skip opening quote
             pos++;
             int endPos = ba.indexOf('"', pos);
-- 
cgit v1.2.3