From e7ac2a9bba2925149bac6dda0f391275997abada Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Samuel=20R=C3=B8dal?= Date: Fri, 26 Apr 2013 10:36:04 +0200 Subject: Prevent crash due to giving QWidget::update() a large rect. We can simply clip the update rect against the widget's rect and return if it's empty. Otherwise we risk ending up with update rects that are larger than INT_MAX due to multiple update rects being merged. Task-number: QTBUG-30876 Change-Id: I23bd0149fbe8d1a007a60b228e6bddb45dc4fc32 Reviewed-by: Thiago Macieira Reviewed-by: Gunnar Sletta (cherry picked from commit a298216bb4383dbe96688dfb80da0cd875766de0) --- src/gui/kernel/qwidget.cpp | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/gui/kernel/qwidget.cpp b/src/gui/kernel/qwidget.cpp index b2ffac712a..481f3235d6 100644 --- a/src/gui/kernel/qwidget.cpp +++ b/src/gui/kernel/qwidget.cpp @@ -10561,11 +10561,16 @@ void QWidget::update() */ void QWidget::update(const QRect &rect) { - if (!isVisible() || !updatesEnabled() || rect.isEmpty()) + if (!isVisible() || !updatesEnabled()) + return; + + QRect r = rect & QWidget::rect(); + + if (r.isEmpty()) return; if (testAttribute(Qt::WA_WState_InPaintEvent)) { - QApplication::postEvent(this, new QUpdateLaterEvent(rect)); + QApplication::postEvent(this, new QUpdateLaterEvent(r)); return; } @@ -10578,9 +10583,9 @@ void QWidget::update(const QRect &rect) #endif // QT_MAC_USE_COCOA QTLWExtra *tlwExtra = window()->d_func()->maybeTopData(); if (tlwExtra && !tlwExtra->inTopLevelResize && tlwExtra->backingStore) - tlwExtra->backingStore->markDirty(rect, this); + tlwExtra->backingStore->markDirty(r, this); } else { - d_func()->repaint_sys(rect); + d_func()->repaint_sys(r); } } -- cgit v1.2.3