whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Painting: handle large and negative dash offset values 

The mapping of the dash offset into the dash pattern was susceptible
to int overflow.

Pick-to: 6.2 6.1 5.15
Change-Id: I254ed40b323ef516d10abc8e6008b14cfc23d2a0
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
bb10
Eirik Aavitsland 2021-08-18 12:48:57 +02:00
parent 279a434c1c
commit ca604964f6
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/gui/painting/qpaintengine_raster.cpp
View File

@ -1633,8 +1633,9 @@ void QRasterPaintEngine::stroke(const QVectorPath &path, const QPen &pen)
patternLength += pattern.at(i);
if (patternLength > 0) {
int n = qFloor(dashOffset / patternLength);
dashOffset -= n * patternLength;
dashOffset = std::fmod(dashOffset, patternLength);
if (dashOffset < 0)
dashOffset += patternLength;
while (dashOffset >= pattern.at(dashIndex)) {
dashOffset -= pattern.at(dashIndex);
if (++dashIndex >= pattern.size())

4
src/gui/painting/qstroker.cpp
View File

@ -1133,7 +1133,9 @@ void QDashStroker::processCurrentSubpath()
qreal doffset = m_dashOffset * m_stroke_width;
// make sure doffset is in range [0..sumLength)
doffset -= qFloor(doffset * invSumLength) * sumLength;
doffset = std::fmod(doffset, sumLength);
if (doffset < 0)
doffset += sumLength;
while (doffset >= dashes[idash]) {
doffset -= dashes[idash];