QImageWriter/XPM: Fix out of bounds string access

Fix warnings:
QWWARN  : tst_QImageReader::readFromFileAfterJunk(xpm) Using QCharRef with an index pointing outside the valid range of a QString. The corresponding behavior is deprecated, and will be changed in a future version of Qt.
QWARN  : tst_QImageReader::readFromFileAfterJunk(xpm) Using QCharRef with an index pointing outside the valid range of a QString. The corresponding behavior is deprecated, and will be changed in a future version of Qt.
QWARN  : tst_QImageReader::readFromFileAfterJunk(xpm) Using QCharRef with an index pointing outside the valid range of a QString. The corresponding behavior is deprecated, and will be changed in a future version of Qt.

introduced by qtbase/c2d2757bccc68e1b981df059786c2e76f2969530 (5.14).

Refactor write_xpm_image() to use a QByteArray and append().

Change-Id: I25e6270e2e5fcb868d4ee38e3b294afc7ee27dcc
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
 

1 files changed, 11 insertions, 19 deletions

diff --git a/src/gui/image/qxpmhandler.cpp b/src/gui/image/qxpmhandler.cpp
index deff56aa58..cf105b250a 100644
--- a/src/gui/image/qxpmhandler.cpp
+++ b/src/gui/image/qxpmhandler.cpp
@@ -1125,8 +1125,6 @@ static bool write_xpm_image(const QImage &sourceImage, QIODevice *device, const
             break;
     }
 
-    QString line;
-
     // write header
     QTextStream s(device);
     s << "/* XPM */" << Qt::endl
@@ -1137,35 +1135,29 @@ static bool write_xpm_image(const QImage &sourceImage, QIODevice *device, const
     QMap<QRgb, int>::Iterator c = colorMap.begin();
     while (c != colorMap.end()) {
         QRgb color = c.key();
-        if (image.format() != QImage::Format_RGB32 && !qAlpha(color))
-            line = QString::asprintf("\"%s c None\"",
-                                     xpm_color_name(cpp, *c));
-        else
-            line = QString::asprintf("\"%s c #%02x%02x%02x\"",
-                                     xpm_color_name(cpp, *c),
-                                     qRed(color),
-                                     qGreen(color),
-                                     qBlue(color));
+        const QString line = image.format() != QImage::Format_RGB32 && !qAlpha(color)
+            ? QString::asprintf("\"%s c None\"", xpm_color_name(cpp, *c))
+            : QString::asprintf("\"%s c #%02x%02x%02x\"", xpm_color_name(cpp, *c),
+                                qRed(color), qGreen(color), qBlue(color));
         ++c;
         s << ',' << Qt::endl << line;
     }
 
     // write pixels, limit to 4 characters per pixel
-    line.truncate(cpp*w);
+    QByteArray line;
     for(y=0; y<h; y++) {
+        line.clear();
         const QRgb *yp = reinterpret_cast<const QRgb *>(image.constScanLine(y));
-        int cc = 0;
         for(x=0; x<w; x++) {
             int color = (int)(*(yp + x));
             const QByteArray chars(xpm_color_name(cpp, colorMap[color]));
-            line[cc++] = QLatin1Char(chars[0]);
+            line.append(chars[0]);
             if (cpp > 1) {
-                line[cc++] = QLatin1Char(chars[1]);
+                line.append(chars[1]);
                 if (cpp > 2) {
-                    line[cc++] = QLatin1Char(chars[2]);
-                    if (cpp > 3) {
-                        line[cc++] = QLatin1Char(chars[3]);
-                    }
+                    line.append(chars[2]);
+                    if (cpp > 3)
+                        line.append(chars[3]);
                 }
             }
         }