Painting: handle large and negative dash offset values

The mapping of the dash offset into the dash pattern was susceptible
to int overflow.

Pick-to: 6.2 6.1 5.15
Change-Id: I254ed40b323ef516d10abc8e6008b14cfc23d2a0
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 6 insertions, 3 deletions

diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index 70fce7d253..6dcb3419ea 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -1633,8 +1633,9 @@ void QRasterPaintEngine::stroke(const QVectorPath &path, const QPen &pen)
             patternLength += pattern.at(i);
 
         if (patternLength > 0) {
-            int n = qFloor(dashOffset / patternLength);
-            dashOffset -= n * patternLength;
+            dashOffset = std::fmod(dashOffset, patternLength);
+            if (dashOffset < 0)
+                dashOffset += patternLength;
             while (dashOffset >= pattern.at(dashIndex)) {
                 dashOffset -= pattern.at(dashIndex);
                 if (++dashIndex >= pattern.size())
diff --git a/src/gui/painting/qstroker.cpp b/src/gui/painting/qstroker.cpp
index 79194c7cf8..d814dd0ea5 100644
--- a/src/gui/painting/qstroker.cpp
+++ b/src/gui/painting/qstroker.cpp
@@ -1133,7 +1133,9 @@ void QDashStroker::processCurrentSubpath()
     qreal doffset = m_dashOffset * m_stroke_width;
 
     // make sure doffset is in range [0..sumLength)
-    doffset -= qFloor(doffset * invSumLength) * sumLength;
+    doffset = std::fmod(doffset, sumLength);
+    if (doffset < 0)
+        doffset += sumLength;
 
     while (doffset >= dashes[idash]) {
         doffset -= dashes[idash];