whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid overflows in variantHash() 

Fixes: oss-fuzz-24702
Pick-to: 5.12 5.15
Change-Id: I876bac9e2c276693e59802dfeeea2229a873ee34
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
bb10
Robert Loehning 2020-08-27 20:06:27 +02:00
parent 0bd770fb87
commit e0da5159dc
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/gui/text/qtextformat.cpp
View File

@ -287,13 +287,13 @@ static inline size_t variantHash(const QVariant &variant)
switch (variant.userType()) { // sorted by occurrence frequency
case QMetaType::QString: return qHash(variant.toString());
case QMetaType::Double: return qHash(variant.toDouble());
case QMetaType::Int: return 0x811890 + variant.toInt();
case QMetaType::Int: return 0x811890U + variant.toInt();
case QMetaType::QBrush:
return 0x01010101 + hash(qvariant_cast<QBrush>(variant));
case QMetaType::Bool: return 0x371818 + variant.toBool();
case QMetaType::QPen: return 0x02020202 + hash(qvariant_cast<QPen>(variant));
case QMetaType::QVariantList:
return 0x8377 + qvariant_cast<QVariantList>(variant).count();
return 0x8377U + qvariant_cast<QVariantList>(variant).count();
case QMetaType::QColor: return hash(qvariant_cast<QColor>(variant));
case QMetaType::QTextLength:
return 0x377 + hash(qvariant_cast<QTextLength>(variant).rawValue());