From f98fe1ba41002f936aa2fc3dac0f7b27fc290938 Mon Sep 17 00:00:00 2001 From: Lars Knoll Date: Fri, 29 May 2020 10:24:31 +0200 Subject: [PATCH] Fix UB in QGraphicsScene::wheelEvent() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit operator--() would iterate before begin() if the list was empty. This is UB, and will crash in Qt 6, where begin()/end() can return an iterator pointing to a nullptr if the list is empty. Change-Id: I39c3a8ebb09fcad75d42019b02426ac5ac05eed9 Reviewed-by: Alex Blasche Reviewed-by: Mårten Nordheim --- src/widgets/graphicsview/qgraphicsscene.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/widgets/graphicsview/qgraphicsscene.cpp b/src/widgets/graphicsview/qgraphicsscene.cpp index d5ab1afd92..ba115b7485 100644 --- a/src/widgets/graphicsview/qgraphicsscene.cpp +++ b/src/widgets/graphicsview/qgraphicsscene.cpp @@ -4101,7 +4101,8 @@ void QGraphicsScene::wheelEvent(QGraphicsSceneWheelEvent *wheelEvent) // Remove all popups after the one found, or all or them if no popup is under the mouse. // Then continue with the event. QList::const_iterator iter = d->popupWidgets.constEnd(); - while (--iter >= d->popupWidgets.constBegin() && !wheelCandidates.isEmpty()) { + while (iter > d->popupWidgets.constBegin() && !wheelCandidates.isEmpty()) { + --iter; if (wheelCandidates.first() == *iter || (*iter)->isAncestorOf(wheelCandidates.first())) break; d->removePopup(*iter);