From 7878c8b6f3ed3a3e17489a438d50aa62f9bc85db Mon Sep 17 00:00:00 2001
From: Joni Poikelin <joni.poikelin@qt.io>
Date: Tue, 23 Jan 2024 09:51:01 +0200
Subject: [PATCH] Fix out of bounds access during QTextDocument cloning

Fixes: QTBUG-120962
Pick-to: 6.6 6.5
Change-Id: Ib2a35acd5a0d673b39556a4aa930e37eb40b39b2
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
(cherry picked from commit 96f1ef1c1c43a965697022f99105c11613129e3d)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
---
 src/gui/text/qtextformat.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/gui/text/qtextformat.cpp b/src/gui/text/qtextformat.cpp
index e7dcd3cb9c1..509b2eb7ccb 100644
--- a/src/gui/text/qtextformat.cpp
+++ b/src/gui/text/qtextformat.cpp
@@ -3993,7 +3993,7 @@ bool QTextFormatCollection::hasFormatCached(const QTextFormat &format) const
 
 int QTextFormatCollection::objectFormatIndex(int objectIndex) const
 {
-    if (objectIndex == -1)
+    if (objectIndex == -1 || objectIndex >= objFormats.size())
         return -1;
     return objFormats.at(objectIndex);
 }