1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix QDomNamedNodeMap::item crash with negative index

Browse Source 
Task-number: QTBUG-49113
Change-Id: I62dee4c112b73a25628657bc3d2ae675f26b87d8
Reviewed-by: David Faure <david.faure@kdab.com>
This commit is contained in:
Joni Poikelin 2015-10-29 09:43:33 +02:00
parent 26238aca8c
commit b20d6cded7
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/xml/dom/qdom.cpp
View File

@ -3142,7 +3142,7 @@ QDomNodePrivate* QDomNamedNodeMapPrivate::removeNamedItem(const QString& name)
QDomNodePrivate* QDomNamedNodeMapPrivate::item(int index) const
{
if (index >= length())
if (index >= length() || index < 0)
return 0;
return *(map.constBegin() + index);
}

9
tests/auto/xml/dom/qdom/tst_qdom.cpp
View File

@ -119,6 +119,7 @@ private slots:
void cloneDTD_QTBUG8398() const;
void DTDNotationDecl();
void DTDEntityDecl();
void QTBUG49113_dontCrashWithNegativeIndex() const;
void cleanupTestCase() const;
@ -1979,5 +1980,13 @@ void tst_QDom::DTDEntityDecl()
QCOMPARE(doctype.namedItem(QString("logo")).toEntity().notationName(), QString("gif"));
}
void tst_QDom::QTBUG49113_dontCrashWithNegativeIndex() const
{
QDomDocument doc;
QDomElement elem = doc.appendChild(doc.createElement("root")).toElement();
QDomNode node = elem.attributes().item(-1);
QVERIFY(node.isNull());
}
QTEST_MAIN(tst_QDom)
#include "tst_qdom.moc"