65a1d41a09
When showing line and paragraph separators at an offset from the start of the string, the end of string pointer would be incorrectly set, and we would read past the end of the string. If any part of this memory happened to match the line or paragraph separator, then we would overwrite it and have a crash. I couldn't find any reliable way to test this, since the crash depends on the contents of the memory after the string allocated by the algorithm. But with an overflow of 100 000 characters, I found that it crashed every time I ran the test. [ChangeLog][QtGui][Text] Fixed potential crash when using QTextOption::ShowLineAndParagraphSeparators. Task-number: QTBUG-69661 Change-Id: I17d1996b883560bacdc7ce114c8aeb2b0108faea Reviewed-by: JiDe Zhang <zccrs@live.com> Reviewed-by: Michal Lazo <xlazom00@gmail.com> Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com> |
||
|---|---|---|
| .. | ||
| qabstracttextdocumentlayout | ||
| qcssparser | ||
| qfont | ||
| qfontcache | ||
| qfontdatabase | ||
| qfontmetrics | ||
| qglyphrun | ||
| qinputcontrol | ||
| qrawfont | ||
| qstatictext | ||
| qsyntaxhighlighter | ||
| qtextblock | ||
| qtextcursor | ||
| qtextdocument | ||
| qtextdocumentfragment | ||
| qtextdocumentlayout | ||
| qtextformat | ||
| qtextlayout | ||
| qtextlist | ||
| qtextobject | ||
| qtextodfwriter | ||
| qtextpiecetable | ||
| qtextscriptengine | ||
| qtexttable | ||
| qzip | ||
| text.pro | ||