Implement custom deserializer to add our own sanity checks

This is a rough first implementation in preparation of writing
proper serializers independently of QDataStream.

Thanks to @chaign_c (https://twitter.com/chaign_c/) for finding
issues with QDataStream that prompted this change.

src/common/CMakeLists.txt

@@ -40,6 +40,8 @@ set(SOURCES
     transfermanager.cpp
     util.cpp
 
+    serializers/serializers.cpp
+
     protocols/datastream/datastreampeer.cpp
     protocols/legacy/legacypeer.cpp
 

src/common/protocols/datastream/datastreampeer.cpp

@@ -25,6 +25,7 @@
 
 #include "datastreampeer.h"
 #include "quassel.h"
+#include "serializers/serializers.h"
 
 using namespace Protocol;
 
@@ -59,7 +60,8 @@ void DataStreamPeer::processMessage(const QByteArray &msg)
     QDataStream stream(msg);
     stream.setVersion(QDataStream::Qt_4_2);
     QVariantList list;
-    stream >> list;
+    if (!Serializers::deserialize(stream, features(), list))
+        close("Peer sent corrupt data, closing down!");
     if (stream.status() != QDataStream::Ok) {
         close("Peer sent corrupt data, closing down!");
         return;

src/common/protocols/legacy/legacypeer.cpp

@@ -24,6 +24,7 @@
 
 #include "legacypeer.h"
 #include "quassel.h"
+#include "serializers/serializers.h"
 
 /* version.inc is no longer used for this */
 const uint protocolVersion = 10;
@@ -63,7 +64,10 @@ void LegacyPeer::processMessage(const QByteArray &msg)
     QVariant item;
     if (_useCompression) {
         QByteArray rawItem;
-        stream >> rawItem;
+        if (!Serializers::deserialize(stream, features(), rawItem)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }
 
         int nbytes = rawItem.size();
         if (nbytes <= 4) {
@@ -78,10 +82,15 @@ void LegacyPeer::processMessage(const QByteArray &msg)
 
         QDataStream itemStream(&rawItem, QIODevice::ReadOnly);
         itemStream.setVersion(QDataStream::Qt_4_2);
-        itemStream >> item;
-    }
-    else {
-        stream >> item;
+        if (!Serializers::deserialize(itemStream, features(), item)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }
+    } else {
+        if (!Serializers::deserialize(stream, features(), item)) {
+            close("Peer sent corrupt data: unable to load QVariant!");
+            return;
+        }
     }
 
     if (stream.status() != QDataStream::Ok || !item.isValid()) {