Fix memory corruption on scaled emojis

Bitmap glyphs are returned prescaled, which means we should include
the transform in their bounding box.

Additionally painting them should stick the smallest rect to avoid
writing outside the allocated area, and assert in debug builds.

Task-number: QTBUG-64239
Change-Id: I5f877d36566891323f528018f910798344ba4ce2
Reviewed-by: Konstantin Ritt <ritt.ks@gmail.com>
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>

2 files changed, 21 insertions, 11 deletions

diff --git a/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp b/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp
index 64a0ef6fe8..85bedff5e6 100644
--- a/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp
+++ b/src/platformsupport/fontdatabases/freetype/qfontengine_ft.cpp
@@ -1776,15 +1776,25 @@ QFixed QFontEngineFT::scaledBitmapMetrics(QFixed m) const
     return m * scalableBitmapScaleFactor;
 }
 
-glyph_metrics_t QFontEngineFT::scaledBitmapMetrics(const glyph_metrics_t &m) const
+glyph_metrics_t QFontEngineFT::scaledBitmapMetrics(const glyph_metrics_t &m, const QTransform &t) const
 {
+    QTransform trans(t);
+    const qreal scaleFactor = scalableBitmapScaleFactor.toReal();
+    trans.scale(scaleFactor, scaleFactor);
+
+    QRectF rect(m.x.toReal(), m.y.toReal(), m.width.toReal(), m.height.toReal());
+    QPointF offset(m.xoff.toReal(), m.yoff.toReal());
+
+    rect = trans.mapRect(rect);
+    offset = trans.map(offset);
+
     glyph_metrics_t metrics;
-    metrics.x = scaledBitmapMetrics(m.x);
-    metrics.y = scaledBitmapMetrics(m.y);
-    metrics.width = scaledBitmapMetrics(m.width);
-    metrics.height = scaledBitmapMetrics(m.height);
-    metrics.xoff = scaledBitmapMetrics(m.xoff);
-    metrics.yoff = scaledBitmapMetrics(m.yoff);
+    metrics.x = QFixed::fromReal(rect.x());
+    metrics.y = QFixed::fromReal(rect.y());
+    metrics.width = QFixed::fromReal(rect.width());
+    metrics.height = QFixed::fromReal(rect.height());
+    metrics.xoff = QFixed::fromReal(offset.x());
+    metrics.yoff = QFixed::fromReal(offset.y());
     return metrics;
 }
 
@@ -1878,7 +1888,7 @@ glyph_metrics_t QFontEngineFT::boundingBox(const QGlyphLayout &glyphs)
         unlockFace();
 
     if (isScalableBitmap())
-        overall = scaledBitmapMetrics(overall);
+        overall = scaledBitmapMetrics(overall, QTransform());
     return overall;
 }
 
@@ -1917,7 +1927,7 @@ glyph_metrics_t QFontEngineFT::boundingBox(glyph_t glyph)
         unlockFace();
 
     if (isScalableBitmap())
-        overall = scaledBitmapMetrics(overall);
+        overall = scaledBitmapMetrics(overall, QTransform());
     return overall;
 }
 
@@ -1955,7 +1965,7 @@ glyph_metrics_t QFontEngineFT::alphaMapBoundingBox(glyph_t glyph, QFixed subPixe
     }
 
     if (isScalableBitmap())
-        overall = scaledBitmapMetrics(overall);
+        overall = scaledBitmapMetrics(overall, matrix);
     return overall;
 }
 
diff --git a/src/platformsupport/fontdatabases/freetype/qfontengine_ft_p.h b/src/platformsupport/fontdatabases/freetype/qfontengine_ft_p.h
index 2993e3b616..c063f5df30 100644
--- a/src/platformsupport/fontdatabases/freetype/qfontengine_ft_p.h
+++ b/src/platformsupport/fontdatabases/freetype/qfontengine_ft_p.h
@@ -321,7 +321,7 @@ private:
     int loadFlags(QGlyphSet *set, GlyphFormat format, int flags, bool &hsubpixel, int &vfactor) const;
     bool shouldUseDesignMetrics(ShaperFlags flags) const;
     QFixed scaledBitmapMetrics(QFixed m) const;
-    glyph_metrics_t scaledBitmapMetrics(const glyph_metrics_t &m) const;
+    glyph_metrics_t scaledBitmapMetrics(const glyph_metrics_t &m, const QTransform &matrix) const;
 
     GlyphFormat defaultFormat;
     FT_Matrix matrix;