1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid reading outside allocated buffer

Browse Source 
Bound the inverse lookup result on the low end as well.

Fixes: QTBUG-104583
Change-Id: Id357fe1c39c88776075d737b08fc2864a2b6e829
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
(cherry picked from commit a2501fff818971a375a927038792140aed6ef4b6)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Allan Sandfeld Jensen 2022-06-27 10:51:58 +02:00 committed by Qt Cherry-pick Bot
parent 257e3fee16
commit b2fe6b1c05
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gui/painting/qcolortransfertable_p.h
View File

@ -105,6 +105,8 @@ public:
uint32_t i = static_cast<uint32_t>(std::floor(resultLargerThan * (m_tableSize - 1)));
auto it = std::lower_bound(m_table16.cbegin() + i, m_table16.cend(), v);
i = it - m_table16.cbegin();
if (i == 0)
return 0.0f;
if (i >= m_tableSize - 1)
return 1.0f;
const float y1 = m_table16[i - 1];
@ -119,6 +121,8 @@ public:
uint32_t i = static_cast<uint32_t>(std::floor(resultLargerThan * (m_tableSize - 1)));
auto it = std::lower_bound(m_table8.cbegin() + i, m_table8.cend(), v);
i = it - m_table8.cbegin();
if (i == 0)
return 0.0f;
if (i >= m_tableSize - 1)
return 1.0f;
const float y1 = m_table8[i - 1];