1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix get out of bounds index in QSortFilterProxyModel::filterAcceptsRow

Browse Source 
Before calling the index function, we need to check the validity of the parameters.

Fixes: QTBUG-91878
Change-Id: I9ec7265fff3f81b8a288c4ba8fae606a2ec808a6
Reviewed-by: David Faure <david.faure@kdab.com>
(cherry picked from commit b8802071ed00689373da5817fc4824a30b5fcf86)
This commit is contained in:
ChunLin Wang 2021-03-31 17:54:49 +08:00
parent a7b9a9328e
commit c701e6bb38
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/corelib/itemmodels/qsortfilterproxymodel.cpp
View File

@ -3004,8 +3004,9 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
if (d->filter_data.pattern().isEmpty()) if (d->filter_data.pattern().isEmpty())
return true; return true;
int column_count = d->model->columnCount(source_parent);
if (d->filter_column == -1) { if (d->filter_column == -1) {
int column_count = d->model->columnCount(source_parent);
for (int column = 0; column < column_count; ++column) { for (int column = 0; column < column_count; ++column) {
QModelIndex source_index = d->model->index(source_row, column, source_parent); QModelIndex source_index = d->model->index(source_row, column, source_parent);
QString key = d->model->data(source_index, d->filter_role).toString(); QString key = d->model->data(source_index, d->filter_role).toString();
@ -3014,9 +3015,10 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
} }
return false; return false;
} }
QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
if (!source_index.isValid()) // the column may not exist if (d->filter_column >= column_count) // the column may not exist
return true; return true;
QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
QString key = d->model->data(source_index, d->filter_role).toString(); QString key = d->model->data(source_index, d->filter_role).toString();
return d->filter_data.match(key).hasMatch(); return d->filter_data.match(key).hasMatch();
} }

17
tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp
View File

@ -117,6 +117,7 @@ private Q_SLOTS:
void shouldPropagateDropAfterLastRow_data(); void shouldPropagateDropAfterLastRow_data();
void shouldPropagateDropAfterLastRow(); void shouldPropagateDropAfterLastRow();
void qtbug91788(); void qtbug91788();
void qtbug91878();
private: private:
QStandardItemModel mod; QStandardItemModel mod;
@ -843,6 +844,22 @@ void tst_QConcatenateTablesProxyModel::qtbug91788()
QCOMPARE(proxyConcat.columnCount(), 0); QCOMPARE(proxyConcat.columnCount(), 0);
} }
void tst_QConcatenateTablesProxyModel::qtbug91878()
{
QStandardItemModel m;
m.setRowCount(4);
m.setColumnCount(4);
QConcatenateTablesProxyModel pm;
QSortFilterProxyModel proxyFilter;
proxyFilter.setSourceModel(&pm);
proxyFilter.setFilterFixedString("something");
pm.addSourceModel(&m); // This should not assert
QCOMPARE(pm.columnCount(), 4);
QCOMPARE(pm.rowCount(), 4);
}
QTEST_GUILESS_MAIN(tst_QConcatenateTablesProxyModel) QTEST_GUILESS_MAIN(tst_QConcatenateTablesProxyModel)
#include "tst_qconcatenatetablesproxymodel.moc" #include "tst_qconcatenatetablesproxymodel.moc"