1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid converting supersized QRectF to QRect

Browse Source 
Check that the sizes are even representable when checking if clipping is
necessary.

Fixes oss-fuzz 23630

Change-Id: I95d6873d28b0e4f47aae7666f7ee96b745dc997b
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
(cherry picked from commit 177c0ef204e35938f3fef7bd7be5425d6804ec82)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Allan Sandfeld Jensen 2020-06-23 09:50:54 +02:00 committed by Qt Cherry-pick Bot
parent 90c85b880e
commit 43f2244581
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/gui/painting/qpaintengine_raster.cpp
View File

@ -1810,9 +1810,9 @@ void QRasterPaintEngine::fill(const QVectorPath &path, const QBrush &brush)
// ### Optimize for non transformed ellipses and rectangles...
QRectF cpRect = path.controlPointRect();
const QRect pathDeviceRect = s->matrix.mapRect(cpRect).toRect();
const QRectF pathDeviceRect = s->matrix.mapRect(cpRect);
// Skip paths that by conservative estimates are completely outside the paint device.
if (!pathDeviceRect.intersects(d->deviceRect))
if (!pathDeviceRect.intersects(QRectF(d->deviceRect)))
return;
ProcessSpans blend = d->getBrushFunc(pathDeviceRect, &s->brushData);
@ -3074,7 +3074,12 @@ bool QRasterPaintEnginePrivate::isUnclipped(const QRect &rect,
inline bool QRasterPaintEnginePrivate::isUnclipped(const QRectF &rect,
int penWidth) const
{
return isUnclipped(rect.normalized().toAlignedRect(), penWidth);
const QRectF norm = rect.normalized();
if (norm.left() < INT_MIN || norm.top() < INT_MIN
|| norm.right() > INT_MAX || norm.bottom() > INT_MAX
|| norm.width() > INT_MAX || norm.height() > INT_MAX)
return false;
return isUnclipped(norm.toAlignedRect(), penWidth);
}
inline ProcessSpans