1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix invalid pointer return with QGridLayout::itemAt(-1)

Browse Source 
QGridLayout::takeAt() and QLayoutItem *itemAt() only check the upper bound.
If the index < 0, these function will return invalid pointer.

Fixes: QTBUG-91261
Change-Id: Idfb9fb6228b9707f817353b04974da16205a835c
Reviewed-by: Giuseppe D'Angelo <giuseppe.dangelo@kdab.com>
(cherry picked from commit c47bb4478a4c3a29c0505d7d89755f40601b326f)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
This commit is contained in:
Zhang Yu 2021-02-22 09:25:01 +08:00 committed by Qt Cherry-pick Bot
parent 90267af5df
commit d3b24a14bb
2 changed files with 54 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/widgets/kernel/qgridlayout.cpp
View File

@ -149,14 +149,14 @@ public:
QRect cellRect(int row, int col) const; QRect cellRect(int row, int col) const;
inline QLayoutItem *itemAt(int index) const { inline QLayoutItem *itemAt(int index) const {
if (index < things.count()) if (index >= 0 && index < things.count())
return things.at(index)->item(); return things.at(index)->item();
else else
return nullptr; return nullptr;
} }
inline QLayoutItem *takeAt(int index) { inline QLayoutItem *takeAt(int index) {
Q_Q(QGridLayout); Q_Q(QGridLayout);
if (index < things.count()) { if (index >= 0 && index < things.count()) {
if (QGridBox *b = things.takeAt(index)) { if (QGridBox *b = things.takeAt(index)) {
QLayoutItem *item = b->takeItem(); QLayoutItem *item = b->takeItem();
if (QLayout *l = item->layout()) { if (QLayout *l = item->layout()) {
@ -184,7 +184,7 @@ public:
} }
void getItemPosition(int index, int *row, int *column, int *rowSpan, int *columnSpan) const { void getItemPosition(int index, int *row, int *column, int *rowSpan, int *columnSpan) const {
if (index < things.count()) { if (index >= 0 && index < things.count()) {
const QGridBox *b = things.at(index); const QGridBox *b = things.at(index);
int toRow = b->toRow(rr); int toRow = b->toRow(rr);
int toCol = b->toCol(cc); int toCol = b->toCol(cc);

51
tests/auto/widgets/kernel/qgridlayout/tst_qgridlayout.cpp
View File

@ -75,6 +75,7 @@ private slots:
void taskQTBUG_40609_addingWidgetToItsOwnLayout(); void taskQTBUG_40609_addingWidgetToItsOwnLayout();
void taskQTBUG_40609_addingLayoutToItself(); void taskQTBUG_40609_addingLayoutToItself();
void taskQTBUG_52357_spacingWhenItemIsHidden(); void taskQTBUG_52357_spacingWhenItemIsHidden();
void taskQTBUG_91261_itemIndexRange();
void replaceWidget(); void replaceWidget();
void dontCrashWhenExtendsToEnd(); void dontCrashWhenExtendsToEnd();
}; };
@ -1666,6 +1667,56 @@ void tst_QGridLayout::taskQTBUG_52357_spacingWhenItemIsHidden()
QTRY_COMPARE_WITH_TIMEOUT(tempWidth, button1.width() + button3.width() + layout.spacing(), 1000); QTRY_COMPARE_WITH_TIMEOUT(tempWidth, button1.width() + button3.width() + layout.spacing(), 1000);
} }
void tst_QGridLayout::taskQTBUG_91261_itemIndexRange()
{
QWidget widget;
QGridLayout lay(&widget);
QPushButton *btn = new QPushButton(&widget);
lay.addWidget(btn, 0, 0);
{
auto ptr = lay.itemAt(-1);
QCOMPARE(ptr, nullptr);
ptr = lay.itemAt(0);
QCOMPARE(ptr->widget(), btn);
ptr = lay.itemAt(1);
QCOMPARE(ptr, nullptr);
}
{
int row = -1;
int column = -1;
int rowSpan;
int columnSpan;
lay.getItemPosition(-1, &row, &column, &rowSpan, &columnSpan);
QCOMPARE(row, -1);
QCOMPARE(column, -1);
lay.getItemPosition(1, &row, &column, &rowSpan, &columnSpan);
QCOMPARE(row, -1);
QCOMPARE(column, -1);
lay.getItemPosition(0, &row, &column, &rowSpan, &columnSpan);
QCOMPARE(row, 0);
QCOMPARE(column, 0);
}
{
auto ptr = lay.takeAt(-1);
QCOMPARE(ptr, nullptr);
ptr = lay.takeAt(1);
QCOMPARE(ptr, nullptr);
ptr = lay.takeAt(0);
QCOMPARE(ptr->widget(), btn);
delete ptr;
}
}
void tst_QGridLayout::replaceWidget() void tst_QGridLayout::replaceWidget()
{ {
QWidget wdg; QWidget wdg;