1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QTextHtmlParserNode: Limit colspan to avoid segfault

Browse Source 
This fixes oss-fuzz issue 29758.

[ChangeLog][QtGui][Text] QTextDocument::setHtml: column spans are
limited to 20480, an arbitrarily high but reasonable value.


Fixes: QTBUG-92463
Pick-to: 5.15 6.0 6.1
Change-Id: Ib759e3e3ac0b0d0d483f8e8ce11002e079db3ace
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
This commit is contained in:
Robert Löhning 2021-04-06 19:59:48 +02:00 committed by Thiago Macieira
parent 72ae064886
commit 7473317b52
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/text/qtexthtmlparser.cpp
View File

@ -1670,7 +1670,7 @@ void QTextHtmlParser::applyAttributes(const QStringList &attributes)
node->tableCellRowSpan = qMax(1, node->tableCellRowSpan);
} else if (key == QLatin1String("colspan")) {
if (setIntAttribute(&node->tableCellColSpan, value))
node->tableCellColSpan = qMax(1, node->tableCellColSpan);
node->tableCellColSpan = qBound(1, node->tableCellColSpan, 20480);
}
break;
case Html_table: