Avoid crash in QTextMarkdownWriter::writeBlock()

The inner loop would go out of bounds whenever it tried to find the end
of a run of spaces in a fragment that contained only spaces.

Fixes: QTBUG-104999
Change-Id: I5dda03b31194fff12f6052c458a0eb85d0be5c2b
Pick-to: 6.2 6.3 6.4 6.4.0
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

1 files changed, 2 insertions, 2 deletions

diff --git a/src/gui/text/qtextmarkdownwriter.cpp b/src/gui/text/qtextmarkdownwriter.cpp
index cda1f209ad..a5d8f4cc97 100644
--- a/src/gui/text/qtextmarkdownwriter.cpp
+++ b/src/gui/text/qtextmarkdownwriter.cpp
@@ -540,13 +540,13 @@ int QTextMarkdownWriter::writeBlock(const QTextBlock &block, bool wrap, bool ign
             }
             if (wrap && col + markers.length() * 2 + fragmentText.length() > ColumnLimit) {
                 int i = 0;
-                int fragLen = fragmentText.length();
+                const int fragLen = fragmentText.length();
                 bool breakingLine = false;
                 while (i < fragLen) {
                     if (col >= ColumnLimit) {
                         m_stream << Newline << wrapIndentString;
                         col = m_wrappedLineIndent;
-                        while (fragmentText[i].isSpace())
+                        while (i < fragLen && fragmentText[i].isSpace())
                             ++i;
                     }
                     int j = i + ColumnLimit - col;