From e0da5159dc4f53fcf725ef6e3aa4e04862bcbae0 Mon Sep 17 00:00:00 2001
From: Robert Loehning <robert.loehning@qt.io>
Date: Thu, 27 Aug 2020 20:06:27 +0200
Subject: [PATCH] Avoid overflows in variantHash()

Fixes: oss-fuzz-24702
Pick-to: 5.12 5.15
Change-Id: I876bac9e2c276693e59802dfeeea2229a873ee34
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/gui/text/qtextformat.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/gui/text/qtextformat.cpp b/src/gui/text/qtextformat.cpp
index 043a5c9102..62cc8e84b7 100644
--- a/src/gui/text/qtextformat.cpp
+++ b/src/gui/text/qtextformat.cpp
@@ -287,13 +287,13 @@ static inline size_t variantHash(const QVariant &variant)
     switch (variant.userType()) { // sorted by occurrence frequency
     case QMetaType::QString: return qHash(variant.toString());
     case QMetaType::Double: return qHash(variant.toDouble());
-    case QMetaType::Int: return 0x811890 + variant.toInt();
+    case QMetaType::Int: return 0x811890U + variant.toInt();
     case QMetaType::QBrush:
         return 0x01010101 + hash(qvariant_cast<QBrush>(variant));
     case QMetaType::Bool: return 0x371818 + variant.toBool();
     case QMetaType::QPen: return 0x02020202 + hash(qvariant_cast<QPen>(variant));
     case QMetaType::QVariantList:
-        return 0x8377 + qvariant_cast<QVariantList>(variant).count();
+        return 0x8377U + qvariant_cast<QVariantList>(variant).count();
     case QMetaType::QColor: return hash(qvariant_cast<QColor>(variant));
       case QMetaType::QTextLength:
         return 0x377 + hash(qvariant_cast<QTextLength>(variant).rawValue());