diff options
| author | Robert Loehning <robert.loehning@qt.io> | 2020-10-09 20:10:13 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2020-10-12 10:19:18 +0000 |
| commit | f575ed4b15c97726c64dbceff23237c84ac26480 (patch) | |
| tree | 4347cc729aa9b2584039ca97e9415722f751680d | |
| parent | 4ef7856603ddd19c391c25ef9f6385de23039c20 (diff) | |
Avoid heap-buffer-overflow
[ChangeLog][QCosmeticStroker] Avoid a heap-buffer-overflow found by oss-
fuzz as issue 25243.
Change-Id: I36112f183241679e172ad1ee531e1b929d6f3815
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
(cherry picked from commit 1d778a59f781ecf822c9e3f7777b680fea2c4e62)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/gui/painting/qcosmeticstroker.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gui/painting/qcosmeticstroker.cpp b/src/gui/painting/qcosmeticstroker.cpp index 12c9da6a28..a8285b5c11 100644 --- a/src/gui/painting/qcosmeticstroker.cpp +++ b/src/gui/painting/qcosmeticstroker.cpp @@ -101,7 +101,7 @@ struct Dasher { offset += stroker->patternLength; dashIndex = 0; - while (offset>= pattern[dashIndex]) + while (dashIndex < stroker->patternSize - 1 && offset>= pattern[dashIndex]) ++dashIndex; // qDebug() << " dasher" << offset/64. << reverse << dashIndex; |