From ca604964f651b71f2b2a45a65e741167f520b714 Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Wed, 18 Aug 2021 12:48:57 +0200 Subject: [PATCH] Painting: handle large and negative dash offset values The mapping of the dash offset into the dash pattern was susceptible to int overflow. Pick-to: 6.2 6.1 5.15 Change-Id: I254ed40b323ef516d10abc8e6008b14cfc23d2a0 Reviewed-by: Allan Sandfeld Jensen --- src/gui/painting/qpaintengine_raster.cpp | 5 +++-- src/gui/painting/qstroker.cpp | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp index 70fce7d253..6dcb3419ea 100644 --- a/src/gui/painting/qpaintengine_raster.cpp +++ b/src/gui/painting/qpaintengine_raster.cpp @@ -1633,8 +1633,9 @@ void QRasterPaintEngine::stroke(const QVectorPath &path, const QPen &pen) patternLength += pattern.at(i); if (patternLength > 0) { - int n = qFloor(dashOffset / patternLength); - dashOffset -= n * patternLength; + dashOffset = std::fmod(dashOffset, patternLength); + if (dashOffset < 0) + dashOffset += patternLength; while (dashOffset >= pattern.at(dashIndex)) { dashOffset -= pattern.at(dashIndex); if (++dashIndex >= pattern.size()) diff --git a/src/gui/painting/qstroker.cpp b/src/gui/painting/qstroker.cpp index 79194c7cf8..d814dd0ea5 100644 --- a/src/gui/painting/qstroker.cpp +++ b/src/gui/painting/qstroker.cpp @@ -1133,7 +1133,9 @@ void QDashStroker::processCurrentSubpath() qreal doffset = m_dashOffset * m_stroke_width; // make sure doffset is in range [0..sumLength) - doffset -= qFloor(doffset * invSumLength) * sumLength; + doffset = std::fmod(doffset, sumLength); + if (doffset < 0) + doffset += sumLength; while (doffset >= dashes[idash]) { doffset -= dashes[idash];