From fc6c050b409ec4697a58e8f4fc028a6a4b3d46f7 Mon Sep 17 00:00:00 2001
From: Kim Motoyoshi Kalland <kim.kalland@nokia.com>
Date: Fri, 6 Jan 2012 14:11:55 +0100
Subject: [PATCH] Limit Bezier curve subdivision to maximum 512 line segments.

Avoid running out of time and memory for extreme cases.

Task-number: QTBUG-23443
Change-Id: Iac7799097d61295bb7395a2efe48b3e7d9257919
Reviewed-by: Gunnar Sletta <gunnar.sletta@nokia.com>
---
 src/gui/painting/qbezier.cpp | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/gui/painting/qbezier.cpp b/src/gui/painting/qbezier.cpp
index 4305ea8cbc..75a75ead7d 100644
--- a/src/gui/painting/qbezier.cpp
+++ b/src/gui/painting/qbezier.cpp
@@ -190,9 +190,12 @@ static inline bool findInflections(qreal a, qreal b, qreal c,
 
 void QBezier::addToPolygon(QPolygonF *polygon, qreal bezier_flattening_threshold) const
 {
-    QBezier beziers[32];
+    QBezier beziers[10];
+    int levels[10];
     beziers[0] = *this;
+    levels[0] = 9;
     QBezier *b = beziers;
+    int *lvl = levels;
 
     while (b >= beziers) {
         // check if we can pop the top bezier curve from the stack
@@ -208,23 +211,29 @@ void QBezier::addToPolygon(QPolygonF *polygon, qreal bezier_flattening_threshold
                 qAbs(b->x1 - b->x3) + qAbs(b->y1 - b->y3);
             l = 1.;
         }
-        if (d < bezier_flattening_threshold*l || b == beziers + 31) {
+        if (d < bezier_flattening_threshold*l || *lvl == 0) {
             // good enough, we pop it off and add the endpoint
             polygon->append(QPointF(b->x4, b->y4));
             --b;
+            --lvl;
         } else {
             // split, second half of the polygon goes lower into the stack
             b->split(b+1, b);
+            lvl[1] = --lvl[0];
             ++b;
+            ++lvl;
         }
     }
 }
 
 void QBezier::addToPolygon(QDataBuffer<QPointF> &polygon, qreal bezier_flattening_threshold) const
 {
-    QBezier beziers[32];
+    QBezier beziers[10];
+    int levels[10];
     beziers[0] = *this;
+    levels[0] = 9;
     QBezier *b = beziers;
+    int *lvl = levels;
 
     while (b >= beziers) {
         // check if we can pop the top bezier curve from the stack
@@ -240,14 +249,17 @@ void QBezier::addToPolygon(QDataBuffer<QPointF> &polygon, qreal bezier_flattenin
                 qAbs(b->x1 - b->x3) + qAbs(b->y1 - b->y3);
             l = 1.;
         }
-        if (d < bezier_flattening_threshold*l || b == beziers + 31) {
+        if (d < bezier_flattening_threshold*l || *lvl == 0) {
             // good enough, we pop it off and add the endpoint
             polygon.add(QPointF(b->x4, b->y4));
             --b;
+            --lvl;
         } else {
             // split, second half of the polygon goes lower into the stack
             b->split(b+1, b);
+            lvl[1] = --lvl[0];
             ++b;
+            ++lvl;
         }
     }
 }