From 42f1166a7f2bba2b198e54c7c7c7879e885f2d5a Mon Sep 17 00:00:00 2001 From: Shawn Rutledge Date: Fri, 9 Sep 2022 22:35:24 +0200 Subject: [PATCH] Avoid crash in QTextMarkdownWriter::writeBlock() The inner loop would go out of bounds whenever it tried to find the end of a run of spaces in a fragment that contained only spaces. Fixes: QTBUG-104999 Change-Id: I5dda03b31194fff12f6052c458a0eb85d0be5c2b Reviewed-by: Volker Hilsheimer (cherry picked from commit 9807c4e5afc953444a4b5a161ceb31c68fdf2484) Reviewed-by: Qt Cherry-pick Bot --- src/gui/text/qtextmarkdownwriter.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gui/text/qtextmarkdownwriter.cpp b/src/gui/text/qtextmarkdownwriter.cpp index 4009b77d886..f55269fe411 100644 --- a/src/gui/text/qtextmarkdownwriter.cpp +++ b/src/gui/text/qtextmarkdownwriter.cpp @@ -568,13 +568,13 @@ int QTextMarkdownWriter::writeBlock(const QTextBlock &block, bool wrap, bool ign } if (wrap && col + markers.length() * 2 + fragmentText.length() > ColumnLimit) { int i = 0; - int fragLen = fragmentText.length(); + const int fragLen = fragmentText.length(); bool breakingLine = false; while (i < fragLen) { if (col >= ColumnLimit) { m_stream << Newline << wrapIndentString; col = m_wrappedLineIndent; - while (fragmentText[i].isSpace()) + while (i < fragLen && fragmentText[i].isSpace()) ++i; } int j = i + ColumnLimit - col;