From c067083057274a6736836125952351d8b467924e Mon Sep 17 00:00:00 2001
From: Harald Brinkmann <Harald.Brinkmann@detectomat.com>
Date: Tue, 27 Mar 2018 09:45:03 +0200
Subject: [PATCH] Fix memory corruption in heightForWidth cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Overflowing q_firstCachedHfw caused memory to be overwritten
before q_cachedHfws.

Change-Id: Ibbcc72380f426550cc0569a05c54cd1acd878b33
Reviewed-by: Jan Arve Sæther <jan-arve.saether@qt.io>
---
 src/widgets/kernel/qlayoutitem.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/widgets/kernel/qlayoutitem.cpp b/src/widgets/kernel/qlayoutitem.cpp
index 5c4fc20687..52640daf55 100644
--- a/src/widgets/kernel/qlayoutitem.cpp
+++ b/src/widgets/kernel/qlayoutitem.cpp
@@ -839,7 +839,7 @@ int QWidgetItemV2::heightForWidth(int width) const
         const QSize &size = q_cachedHfws[offset % HfwCacheMaxSize];
         if (size.width() == width) {
             if (q_hfwCacheSize == HfwCacheMaxSize)
-                q_firstCachedHfw = offset;
+                q_firstCachedHfw = offset % HfwCacheMaxSize;
             return size.height();
         }
     }