1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

QTextHtmlParserNode: Limit colspan to avoid segfault

Browse Source 
This fixes oss-fuzz issue 29758.

[ChangeLog][QtGui][Text] QTextDocument::setHtml: column spans are
limited to 20480, an arbitrarily high but reasonable value.


Fixes: QTBUG-92463
Change-Id: Ib759e3e3ac0b0d0d483f8e8ce11002e079db3ace
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 7473317b52dbc15878d81291faa33f21c20d6ec6)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Robert Löhning 2021-04-06 19:59:48 +02:00 committed by Qt Cherry-pick Bot
parent 87ab4f66f2
commit 917509c914
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/text/qtexthtmlparser.cpp
View File

@ -1671,7 +1671,7 @@ void QTextHtmlParser::applyAttributes(const QStringList &attributes)
node->tableCellRowSpan = qMax(1, node->tableCellRowSpan);
} else if (key == QLatin1String("colspan")) {
if (setIntAttribute(&node->tableCellColSpan, value))
node->tableCellColSpan = qMax(1, node->tableCellColSpan);
node->tableCellColSpan = qBound(1, node->tableCellColSpan, 20480);
}
break;
case Html_table: