1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix integer overflow for broken QPainterPaths

Browse Source 
With some bogus input, we can end up with NaN in the
bounding rects of the control points. This in turn
causes problems later when it is converted to ints
and used in code. To avoid it, we exit early if the
rect is invalid (negative or NaN size).

Pick-to: 5.15 6.2 6.3
Fixes: QTBUG-100217
Change-Id: Idbc6700b85cb30198d69fedbf8f3be3e1ab65e40
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
This commit is contained in:
Eskil Abrahamsen Blomfeldt 2022-02-11 14:09:25 +01:00
parent 8275611766
commit d6c4a3edf9
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/gui/painting/qpaintengine_raster.cpp
View File

@ -1725,7 +1725,7 @@ void QRasterPaintEngine::fill(const QVectorPath &path, const QBrush &brush)
QRectF cpRect = path.controlPointRect();
const QRectF pathDeviceRect = s->matrix.mapRect(cpRect);
// Skip paths that by conservative estimates are completely outside the paint device.
if (!pathDeviceRect.intersects(QRectF(d->deviceRect)))
if (!pathDeviceRect.intersects(QRectF(d->deviceRect)) || !pathDeviceRect.isValid())
return;
ProcessSpans blend = d->getBrushFunc(pathDeviceRect, &s->brushData);