From 0bd770fb875d5391dd78df95542c25bd15051938 Mon Sep 17 00:00:00 2001
From: Robert Loehning <robert.loehning@qt.io>
Date: Thu, 27 Aug 2020 16:18:58 +0200
Subject: [PATCH] QTextHtmlParserNode: Avoid extreme values for font's
 pixelsize

They currently cause an integer-overflow in variantHash().

Fixes: oss-fuzz-24702
Pick-to: 5.12 5.15
Change-Id: Ibee4413ca766c8ade9aeff2f2052b82cb9f7d213
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/gui/text/qtexthtmlparser.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/gui/text/qtexthtmlparser.cpp b/src/gui/text/qtexthtmlparser.cpp
index 3eb131b5c0..c2a0fcbec9 100644
--- a/src/gui/text/qtexthtmlparser.cpp
+++ b/src/gui/text/qtexthtmlparser.cpp
@@ -1381,6 +1381,7 @@ void QTextHtmlParserNode::applyCssDeclarations(const QList<QCss::Declaration> &d
     QFont f;
     int adjustment = -255;
     extractor.extractFont(&f, &adjustment);
+    f.setPixelSize(qMin(f.pixelSize(), INT32_MAX / 2));   // avoid even more extreme values
     charFormat.setFont(f, QTextCharFormat::FontPropertiesSpecifiedOnly);
 
     if (adjustment >= -1)