whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix infinite loop in dash stroker 

When the positions were large enough, we would get precision errors
with the floating point numbers.

We calculate the relative position:
  dpos = pos + dashes[istart] - doffset - estart
and then later
  pos = dpos + estart

If estart is a huge number (range of 10^18) and dashes[istart] is
a low number (10^1), then estart + dashes[istart] == estart and
the loop will never progress, dpos will be 0.

Since the loop should never iterate more than dashCount times
(since we cut away all full dash sequences before entering it),
we add a failsafe that exits the loop if it detects the error.

Fixes: QTBUG-99690
Pick-to: 5.15 6.2 6.3
Change-Id: Ia6a42f21b6b4c6adf5cdd703b6483750513a88ba
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
bb10
Eskil Abrahamsen Blomfeldt 2022-02-03 11:01:33 +01:00
parent c984a9bf07
commit 26a0638222
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/gui/painting/qstroker.cpp
View File

@ -1184,6 +1184,7 @@ void QDashStroker::processCurrentSubpath()
// Check if the entire line should be clipped away or simplified
bool clipIt = clipping && !lineIntersectsRect(prev, e, clip_tl, clip_br);
bool skipDashing = elen * invSumLength > repetitionLimit();
int maxDashes = dashCount;
if (skipDashing || clipIt) {
// Cut away full dash sequences.
elen -= std::floor(elen * invSumLength) * sumLength;
@ -1198,7 +1199,7 @@ void QDashStroker::processCurrentSubpath()
pos = estop; // move pos to next path element
done = true;
} else { // Dash is on this line
pos = dpos + estart;
pos = --maxDashes > 0 ? dpos + estart : estop;
done = pos >= estop;
if (++idash >= dashCount)
idash = 0;