diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-02-01 09:47:53 +0100 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2021-02-01 17:38:24 +0000 |
| commit | 0d6aec663cc5a71501485c9d8a05ecbd30df5d14 (patch) | |
| tree | 9c065bdb8ed6192dd284a081e5b86d5fc53a062c /src/gui | |
| parent | ddc1805fa24fa3ca6803ba693a5ac882037042b2 (diff) | |
Avoid int overflow in gradient drawing
Fixes oss-fuzz 29348
Change-Id: I3568a0a7a7e8d87881f5b052c6c00831b53b3842
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
Reviewed-by: Robert Löhning <robert.loehning@qt.io>
(cherry picked from commit 93243b5d6a6726087aeec387366ca699cad4e31c)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'src/gui')
| -rw-r--r-- | src/gui/painting/qdrawhelper.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/gui/painting/qdrawhelper.cpp b/src/gui/painting/qdrawhelper.cpp index ee0e17d917..3cff7386e1 100644 --- a/src/gui/painting/qdrawhelper.cpp +++ b/src/gui/painting/qdrawhelper.cpp @@ -2407,6 +2407,7 @@ static inline SourceFetchProc64 getSourceFetch64(TextureBlendType blendType, QIm #define FIXPT_BITS 8 #define FIXPT_SIZE (1<<FIXPT_BITS) +#define FIXPT_MAX (INT_MAX >> (FIXPT_BITS + 1)) static uint qt_gradient_pixel_fixed(const QGradientData *data, int fixed_pos) { @@ -2503,10 +2504,12 @@ static inline const BlendType * QT_FASTCALL qt_fetch_linear_gradient_template( const BlendType *end = buffer + length; if (affine) { if (inc > qreal(-1e-5) && inc < qreal(1e-5)) { - GradientBase::memfill(buffer, GradientBase::fetchSingle(data->gradient, int(t * FIXPT_SIZE)), length); + if (std::abs(t) < FIXPT_MAX) + GradientBase::memfill(buffer, GradientBase::fetchSingle(data->gradient, int(t * FIXPT_SIZE)), length); + else + GradientBase::memfill(buffer, GradientBase::fetchSingle(data->gradient, t / GRADIENT_STOPTABLE_SIZE), length); } else { - if (t+inc*length < qreal(INT_MAX >> (FIXPT_BITS + 1)) && - t+inc*length > qreal(INT_MIN >> (FIXPT_BITS + 1))) { + if (std::abs(t) < FIXPT_MAX && std::abs(inc) < FIXPT_MAX && std::abs(t + inc * length) < FIXPT_MAX) { // we can use fixed point math int t_fixed = int(t * FIXPT_SIZE); int inc_fixed = int(inc * FIXPT_SIZE); |