diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-01-26 17:29:08 +0100 |
|---|---|---|
| committer | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-01-28 11:02:18 +0100 |
| commit | bfc09b8d8fa6c1a397aff458c644ed424754adf0 (patch) | |
| tree | 048ad40775e6c948e0ee5c4588ec9da0993d399b /src/gui/text/qtextlayout.cpp | |
| parent | 07c248a594e9baf0910d4edd12d5b695abe496b8 (diff) | |
Avoid overflow in text layout
Fixes oss-fuzz issue 29313.
Pick-to: 6.0 5.15
Change-Id: Idbabd162fa9e0dbce687981bdbcc75be37189a61
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Reviewed-by: Robert Löhning <robert.loehning@qt.io>
Diffstat (limited to 'src/gui/text/qtextlayout.cpp')
| -rw-r--r-- | src/gui/text/qtextlayout.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp index d303219bb9..b2b87fb92e 100644 --- a/src/gui/text/qtextlayout.cpp +++ b/src/gui/text/qtextlayout.cpp @@ -820,6 +820,10 @@ QTextLine QTextLayout::createLine() int l = d->lines.size(); if (l && d->lines.at(l-1).length < 0) { QTextLine(l-1, d).setNumColumns(INT_MAX); + if (d->maxWidth > QFIXED_MAX / 2) { + qWarning("QTextLayout: text too long, truncated."); + return QTextLine(); + } } int from = l > 0 ? d->lines.at(l-1).from + d->lines.at(l-1).length + d->lines.at(l-1).trailingSpaces : 0; int strlen = d->layoutData->string.length(); |