Fix get out of bounds index in QSortFilterProxyModel::filterAcceptsRow

Before calling the index function, we need to check the validity of the parameters.

Fixes: QTBUG-91878
Change-Id: I9ec7265fff3f81b8a288c4ba8fae606a2ec808a6
Reviewed-by: David Faure <david.faure@kdab.com>
(cherry picked from commit b8802071ed00689373da5817fc4824a30b5fcf86)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

2 files changed, 22 insertions, 3 deletions

diff --git a/src/corelib/itemmodels/qsortfilterproxymodel.cpp b/src/corelib/itemmodels/qsortfilterproxymodel.cpp
index 88c4c909b3..7c804d52e8 100644
--- a/src/corelib/itemmodels/qsortfilterproxymodel.cpp
+++ b/src/corelib/itemmodels/qsortfilterproxymodel.cpp
@@ -3005,8 +3005,9 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
 
     if (d->filter_data.pattern().isEmpty())
         return true;
+
+    int column_count = d->model->columnCount(source_parent);
     if (d->filter_column == -1) {
-        int column_count = d->model->columnCount(source_parent);
         for (int column = 0; column < column_count; ++column) {
             QModelIndex source_index = d->model->index(source_row, column, source_parent);
             QString key = d->model->data(source_index, d->filter_role).toString();
@@ -3015,9 +3016,10 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
         }
         return false;
     }
-    QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
-    if (!source_index.isValid()) // the column may not exist
+
+    if (d->filter_column >= column_count) // the column may not exist
         return true;
+    QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
     QString key = d->model->data(source_index, d->filter_role).toString();
     return d->filter_data.match(key).hasMatch();
 }
diff --git a/tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp b/tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp
index e1ea7a4552..90972caa57 100644
--- a/tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp
+++ b/tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp
@@ -117,6 +117,7 @@ private Q_SLOTS:
     void shouldPropagateDropAfterLastRow_data();
     void shouldPropagateDropAfterLastRow();
     void qtbug91788();
+    void qtbug91878();
 
 private:
     QStandardItemModel mod;
@@ -843,6 +844,22 @@ void tst_QConcatenateTablesProxyModel::qtbug91788()
     QCOMPARE(proxyConcat.columnCount(), 0);
 }
 
+void tst_QConcatenateTablesProxyModel::qtbug91878()
+{
+    QStandardItemModel m;
+    m.setRowCount(4);
+    m.setColumnCount(4);
+
+    QConcatenateTablesProxyModel pm;
+    QSortFilterProxyModel proxyFilter;
+    proxyFilter.setSourceModel(&pm);
+    proxyFilter.setFilterFixedString("something");
+    pm.addSourceModel(&m);  // This should not assert
+
+    QCOMPARE(pm.columnCount(), 4);
+    QCOMPARE(pm.rowCount(), 4);
+}
+
 QTEST_GUILESS_MAIN(tst_QConcatenateTablesProxyModel)
 
 #include "tst_qconcatenatetablesproxymodel.moc"