whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Guarantee QTextEngine::findItem() returns -1 for invalid strPos 

...and check the returned value where it may cause undefined behavior
(i.e. negative amount of items or iteration from -1 to n).

Change-Id: Ib7bd9ab178526df45b792ad48b91ebbab6be861a
Reviewed-by: Simon Hausmann <simon.hausmann@digia.com>
bb10
Konstantin Ritt 2014-05-22 02:39:44 +03:00 committed by The Qt Project
parent 9b3b33b110
commit be0bfe09ee
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/gui/text/qtextengine.cpp
View File

@ -847,7 +847,7 @@ void QTextEngine::shapeLine(const QScriptLine &line)
int item = findItem(line.from);
if (item == -1)
return;
for (item = findItem(line.from); item <= end; ++item) {
for ( ; item <= end; ++item) {
QScriptItem &si = layoutData->items[item];
if (si.analysis.flags == QScriptAnalysis::Tab) {
ensureSpace(1);
@ -1634,6 +1634,9 @@ bool QTextEngine::isRightToLeft() const
int QTextEngine::findItem(int strPos) const
{
itemize();
if (strPos < 0 || strPos >= layoutData->string.size())
return -1;
int left = 1;
int right = layoutData->items.size()-1;
while(left <= right) {
@ -2053,7 +2056,8 @@ void QTextEngine::justify(const QScriptLine &line)
return;
int firstItem = findItem(line.from);
int nItems = findItem(line.from + line_length - 1) - firstItem + 1;
int lastItem = findItem(line.from + line_length - 1);
int nItems = (firstItem >= 0 && lastItem >= firstItem)? (lastItem-firstItem+1) : 0;
QVarLengthArray<QJustificationPoint> justificationPoints;
int nPoints = 0;

1
src/gui/text/qtextlayout.cpp
View File

@ -1730,6 +1730,7 @@ void QTextLine::layout_helper(int maxGlyphs)
int item = -1;
int newItem = eng->findItem(line.from);
Q_ASSERT(newItem >= 0);
LB_DEBUG("from: %d: item=%d, total %d, width available %f", line.from, newItem, eng->layoutData->items.size(), line.width.toReal());