From ca58764da1cc57c8546607c0a83d085a8c5a298e Mon Sep 17 00:00:00 2001
From: Eirik Aavitsland <eirik.aavitsland@qt.io>
Date: Fri, 16 Mar 2018 15:10:10 +0100
Subject: [PATCH] PDF engine: handle abnormally long string cases

The output routine used a fixed size scratch buffer, with no attempt
to handle overrun. Add a simple fallback code path for such (extremely
rare) cases.

Task-number: QTBUG-66788
Change-Id: I52531b829baeaa48a8fb5a637a020ee9f89d270a
Reviewed-by: Friedemann Kleint <Friedemann.Kleint@qt.io>
---
 src/gui/painting/qpdf.cpp | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/gui/painting/qpdf.cpp b/src/gui/painting/qpdf.cpp
index e421055ef3..e58f9cee4c 100644
--- a/src/gui/painting/qpdf.cpp
+++ b/src/gui/painting/qpdf.cpp
@@ -2045,7 +2045,6 @@ void QPdfEnginePrivate::printString(const QString &string)
 }
 
 
-// For strings up to 10000 bytes only !
 void QPdfEnginePrivate::xprintf(const char* fmt, ...)
 {
     if (!stream)
@@ -2057,12 +2056,18 @@ void QPdfEnginePrivate::xprintf(const char* fmt, ...)
     va_list args;
     va_start(args, fmt);
     int bufsize = qvsnprintf(buf, msize, fmt, args);
-
-    Q_ASSERT(bufsize<msize);
-
     va_end(args);
 
-    stream->writeRawData(buf, bufsize);
+    if (Q_LIKELY(bufsize < msize)) {
+        stream->writeRawData(buf, bufsize);
+    } else {
+        // Fallback for abnormal cases
+        QScopedArrayPointer<char> tmpbuf(new char[bufsize + 1]);
+        va_start(args, fmt);
+        bufsize = qvsnprintf(tmpbuf.data(), bufsize + 1, fmt, args);
+        va_end(args);
+        stream->writeRawData(tmpbuf.data(), bufsize);
+    }
     streampos += bufsize;
 }