From 4b2f5371d9ba7b8d2dc068223866bbb3c8242beb Mon Sep 17 00:00:00 2001 From: Andrei Golubev Date: Thu, 27 Aug 2020 16:05:43 +0200 Subject: [PATCH] Fix subtle issue in tst_qtablewidget Fixed UB when QList::begin() iterator is used after a call to QList::remove(). As QList is now effectively double-ended container, there is no guarantee on iterator validity upon erasure Task-number: QTBUG-84320 Change-Id: I27793f131e8e23a41ac6c2c1db0bdc61ee58891f Reviewed-by: Sona Kurazyan --- src/widgets/itemviews/qtablewidget.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/widgets/itemviews/qtablewidget.cpp b/src/widgets/itemviews/qtablewidget.cpp index f0c138e9ce..ac59271c8d 100644 --- a/src/widgets/itemviews/qtablewidget.cpp +++ b/src/widgets/itemviews/qtablewidget.cpp @@ -589,7 +589,7 @@ void QTableModel::ensureSorted(int column, Qt::SortOrder order, int oldRow = sorting.at(i).second; QTableWidgetItem *item = colItems.at(oldRow); colItems.remove(oldRow); - vit = sortedInsertionIterator(vit, colItems.end(), order, item); + vit = sortedInsertionIterator(colItems.begin(), colItems.end(), order, item); int newRow = qMax((int)(vit - colItems.begin()), 0); if ((newRow < oldRow) && !(*item < *colItems.at(oldRow - 1)) && !(*colItems.at(oldRow - 1) < *item)) newRow = oldRow;