From 3340b82ee990a3c0802eda2a3390a9067a25a13f Mon Sep 17 00:00:00 2001 From: Jacek Poplawski Date: Fri, 12 Jan 2024 11:27:00 +0100 Subject: [PATCH] Make sure the sqrt value in qdrawhelper is non-negative It's possible for the "det" variable to exceed 0 and be negative. This scenario is already handled in one case, this change will fix second case. Fixes: QTBUG-120907 Change-Id: Ib30213b3455b5c6f3b8b8384e78e7b43158f93b5 Reviewed-by: Allan Sandfeld Jensen (cherry picked from commit ba75e7770f7facf5f841e72ca0a4fd2a1a1fb6e1) Reviewed-by: Qt Cherry-pick Bot --- src/gui/painting/qdrawhelper.cpp | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index 5fe0a5b41b3..301e430b11c 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -3255,6 +3255,7 @@ public: static Type null() { return 0; } static Type fetchSingle(const QGradientData& gradient, qreal v) { + Q_ASSERT(std::isfinite(v)); return qt_gradient_pixel(&gradient, v); } static Type fetchSingle(const QGradientData& gradient, int v) @@ -3275,6 +3276,7 @@ public: static Type null() { return QRgba64::fromRgba64(0); } static Type fetchSingle(const QGradientData& gradient, qreal v) { + Q_ASSERT(std::isfinite(v)); return qt_gradient_pixel64(&gradient, v); } static Type fetchSingle(const QGradientData& gradient, int v) @@ -3296,6 +3298,7 @@ public: static Type null() { return QRgbaFloat32::fromRgba64(0,0,0,0); } static Type fetchSingle(const QGradientData& gradient, qreal v) { + Q_ASSERT(std::isfinite(v)); return qt_gradient_pixelFP(&gradient, v); } static Type fetchSingle(const QGradientData& gradient, int v) @@ -3445,7 +3448,13 @@ public: } } else { while (buffer < end) { - *buffer++ = GradientBase::fetchSingle(data->gradient, qSqrt(det) - b); + BlendType result = GradientBase::null(); + if (det >= 0) { + qreal w = qSqrt(det) - b; + result = GradientBase::fetchSingle(data->gradient, w); + } + + *buffer++ = result; det += delta_det; delta_det += delta_delta_det;