diff options
authorEirik Aavitsland <>2020-12-01 10:03:19 +0100
committerQt Cherry-pick Bot <>2020-12-01 22:15:51 +0000
commita34a3526828f592d16755a3b6da02ff8fbf5c32d (patch)
parent0943ad02419f6215915e4a7c98949d1fd9b08c45 (diff)
Cosmetic stroker: avoid overflows for non-finite coordinates
int overflows are usually avoided by clipping the qreal coordinates to the device rect. However the clip function did not handle inf or nan coordinates, so such values would be passed on. Fix by treating any line with such coordinates a fully clipped away, i.e. rejecting it, since it cannot be meaningfully stroked anyway. Fixes oss-fuzz issue 25330. Change-Id: I4646172fc7a7e0a3a5f5cf03ce10ff0fb56b0d03 Reviewed-by: Allan Sandfeld Jensen <> Reviewed-by: Robert Loehning <> (cherry picked from commit cfad8a352ae151dd413af1bdea08e25d56309963) Reviewed-by: Qt Cherry-pick Bot <>
1 files changed, 2 insertions, 0 deletions
diff --git a/src/gui/painting/qcosmeticstroker.cpp b/src/gui/painting/qcosmeticstroker.cpp
index 291e5d3acf..4f0911a9a4 100644
--- a/src/gui/painting/qcosmeticstroker.cpp
+++ b/src/gui/painting/qcosmeticstroker.cpp
@@ -311,6 +311,8 @@ void QCosmeticStroker::setup()
// returns true if the whole line gets clipped away
bool QCosmeticStroker::clipLine(qreal &x1, qreal &y1, qreal &x2, qreal &y2)
+ if (!qIsFinite(x1) || !qIsFinite(y1) || !qIsFinite(x2) || !qIsFinite(y2))
+ return true;
// basic/rough clipping is done in floating point coordinates to avoid
// integer overflow problems.
if (x1 < xmin) {