whytofly
/
qt6-bb10
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

QCosmeticStroker: fix out-of-bounds access in drawPixel() 

Found by UBSan:

  src/gui/painting/qcosmeticstroker.cpp:150:55: runtime error: index -1 out of bounds for type 'QT_FT_Span_ [255]'
  src/gui/painting/qcosmeticstroker.cpp:150:99: runtime error: index -1 out of bounds for type 'QT_FT_Span_ [255]'
  src/gui/painting/qcosmeticstroker.cpp:151:55: runtime error: index -1 out of bounds for type 'QT_FT_Span_ [255]'

That code path makes no sense if no span has been populated
yet, so skip the whole block if current_span == 0.

Change-Id: I832b989e89c118dc48ab5add3a28bb44c1936a76
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@theqtcompany.com>
bb10
Marc Mutz 2016-03-06 15:06:48 +01:00
parent e69e695196
commit fb7ef2b9f5
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/gui/painting/qcosmeticstroker.cpp
View File

@ -141,12 +141,14 @@ inline void drawPixel(QCosmeticStroker *stroker, int x, int y, int coverage)
if (x < cl.x() || x > cl.right() || y < cl.y() || y > cl.bottom())
return;
int lastx = stroker->spans[stroker->current_span-1].x + stroker->spans[stroker->current_span-1].len ;
int lasty = stroker->spans[stroker->current_span-1].y;
if (stroker->current_span > 0) {
const int lastx = stroker->spans[stroker->current_span-1].x + stroker->spans[stroker->current_span-1].len ;
const int lasty = stroker->spans[stroker->current_span-1].y;
if (stroker->current_span == QCosmeticStroker::NSPANS || y < lasty || (y == lasty && x < lastx)) {
stroker->blend(stroker->current_span, stroker->spans, &stroker->state->penData);
stroker->current_span = 0;
if (stroker->current_span == QCosmeticStroker::NSPANS || y < lasty || (y == lasty && x < lastx)) {
stroker->blend(stroker->current_span, stroker->spans, &stroker->state->penData);
stroker->current_span = 0;
}
}
stroker->spans[stroker->current_span].x = ushort(x);