diff options
| author | Volker Hilsheimer <volker.hilsheimer@qt.io> | 2021-07-21 10:15:09 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2021-07-21 16:29:01 +0000 |
| commit | 05b29f141b2b47ed1164fb2afc868618b9585129 (patch) | |
| tree | 63ef5a67878cedd3005a5e46e362c5f92c15f87a | |
| parent | 16cb856bb961830c3e25cd875f8b4407171e1aab (diff) | |
Prevent array-out-of-bounds access
Fixes static analyzer warning 12b19393e18b2394a398806f633c6eee, and
amends a1a6e3d21b1a4fb799dfd245fed6bb6564178894.
In the process, replace the "int& *= double" with correct integer
arithmetic that'll produce the intended result without going via
double.
Done-with: Edward Welbourne <edward.welbourne@qt.io>
Task-number: QTBUG-8096
Change-Id: Ib2aa8ae46a1bfd4d121e61cf99141c0311502215
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
(cherry picked from commit 1ee9496679ea2bf4d043937b83aa72a1b5bb6977)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
| -rw-r--r-- | src/gui/text/qcssparser.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/gui/text/qcssparser.cpp b/src/gui/text/qcssparser.cpp index 62e14e92bb..574436d6f6 100644 --- a/src/gui/text/qcssparser.cpp +++ b/src/gui/text/qcssparser.cpp @@ -1601,13 +1601,17 @@ QSize Declaration::sizeValue() const int x[2] = { 0, 0 }; const int count = d->values.count(); for (int i = 0; i < count; ++i) { + if (i > 1) { + qWarning("QCssParser::sizeValue: Too many values provided"); + break; + } const auto &value = d->values.at(i); const QString valueString = value.variant.toString(); if (valueString.endsWith(u"pt", Qt::CaseInsensitive)) { intValueHelper(value, &x[i], "pt"); // according to https://www.w3.org/TR/css3-values/#absolute-lengths // 1pt = 1/72th of 1 inch, and 1px = 1/96th of 1 inch - x[i] *= 72.0/96.0; + x[i] = (x[i] * 72) / 96; } else { // by default we use 'px' intValueHelper(value, &x[i], "px"); |