diff options
| author | Robert Loehning <robert.loehning@qt.io> | 2020-07-16 21:14:58 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-07-31 13:08:24 +0000 |
| commit | a2b1ab0e6e85f684db15cb793c36145f0bc4e45d (patch) | |
| tree | 46be0d129ecf0822ded8e9e13a5045ba8f156d31 | |
| parent | df65a30d5c13174600ce8bdd9347bca37cf1e77b (diff) | |
Sanitize lengthValue in CSS parser
Limit the LengthData to the integer range before rounding it, taking
into account that qRound() substracts 1 from negative values.
Fixes: oss-fuzz-23220
Change-Id: I1b4383f3c33aac22746831002b2c74fc134faf77
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
(cherry picked from commit 188501fe27899cdc6a1aacf0d8c1a11144bd564a)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/gui/text/qcssparser.cpp | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/src/gui/text/qcssparser.cpp b/src/gui/text/qcssparser.cpp index 325fd26a31..78ddc04afd 100644 --- a/src/gui/text/qcssparser.cpp +++ b/src/gui/text/qcssparser.cpp @@ -416,11 +416,10 @@ LengthData ValueExtractor::lengthValue(const Value& v) static int lengthValueFromData(const LengthData& data, const QFont& f) { - if (data.unit == LengthData::Ex) - return qRound(QFontMetrics(f).xHeight() * data.number); - else if (data.unit == LengthData::Em) - return qRound(QFontMetrics(f).height() * data.number); - return qRound(data.number); + const int scale = (data.unit == LengthData::Ex ? QFontMetrics(f).xHeight() + : data.unit == LengthData::Em ? QFontMetrics(f).height() : 1); + // raised lower limit due to the implementation of qRound() + return qRound(qBound(double(INT_MIN) + 0.1, scale * data.number, double(INT_MAX))); } int ValueExtractor::lengthValue(const Declaration &decl) |