diff options
| author | Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io> | 2022-02-11 14:09:25 +0100 |
|---|---|---|
| committer | Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io> | 2022-02-14 12:51:10 +0100 |
| commit | d6c4a3edf9adb02b6f96d43768db9f90a6623de7 (patch) | |
| tree | f94452ab5bd07beec962783f53dbc072d71e988c /src/gui | |
| parent | 8275611766bceecf045c75a59487d46c8f8a8d4b (diff) | |
Fix integer overflow for broken QPainterPaths
With some bogus input, we can end up with NaN in the
bounding rects of the control points. This in turn
causes problems later when it is converted to ints
and used in code. To avoid it, we exit early if the
rect is invalid (negative or NaN size).
Pick-to: 5.15 6.2 6.3
Fixes: QTBUG-100217
Change-Id: Idbc6700b85cb30198d69fedbf8f3be3e1ab65e40
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Diffstat (limited to 'src/gui')
| -rw-r--r-- | src/gui/painting/qpaintengine_raster.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp index 3bd3a81353..b044b485df 100644 --- a/src/gui/painting/qpaintengine_raster.cpp +++ b/src/gui/painting/qpaintengine_raster.cpp @@ -1725,7 +1725,7 @@ void QRasterPaintEngine::fill(const QVectorPath &path, const QBrush &brush) QRectF cpRect = path.controlPointRect(); const QRectF pathDeviceRect = s->matrix.mapRect(cpRect); // Skip paths that by conservative estimates are completely outside the paint device. - if (!pathDeviceRect.intersects(QRectF(d->deviceRect))) + if (!pathDeviceRect.intersects(QRectF(d->deviceRect)) || !pathDeviceRect.isValid()) return; ProcessSpans blend = d->getBrushFunc(pathDeviceRect, &s->brushData); |