Prevent buffer overrun when getting the glyph images

The change 35bc3dc45aacaf36a8bdfccc7627136cc2e5b185 moved some padding out
of QTextureGlyphCache into the font engines directly, however this was not
done for the DirectWrite font engine so it caused a buffer overrun.

Task-number: QTBUG-41782
Change-Id: I4e643159036f06c5edd8a742dc6694d517a47826
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@theqtcompany.com>

2 files changed, 16 insertions, 2 deletions

diff --git a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
index 648f68bb19..ed512f78ca 100644
--- a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
+++ b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.cpp
@@ -515,8 +515,9 @@ QImage QWindowsFontEngineDirectWrite::imageForGlyph(glyph_t t,
                                              const QTransform &xform)
 {
     glyph_metrics_t metrics = QFontEngine::boundingBox(t, xform);
-    int width = (metrics.width + margin * 2 + 4).ceil().toInt() ;
-    int height = (metrics.height + margin * 2 + 4).ceil().toInt();
+    // This needs to be kept in sync with alphaMapBoundingBox
+    int width = (metrics.width + margin * 2).ceil().toInt() ;
+    int height = (metrics.height + margin * 2).ceil().toInt();
 
     UINT16 glyphIndex = t;
     FLOAT glyphAdvance = metrics.xoff.toReal();
@@ -699,6 +700,18 @@ QString QWindowsFontEngineDirectWrite::fontNameSubstitute(const QString &familyN
     return QSettings(QLatin1String(keyC), QSettings::NativeFormat).value(familyName, familyName).toString();
 }
 
+glyph_metrics_t QWindowsFontEngineDirectWrite::alphaMapBoundingBox(glyph_t glyph, QFixed pos, const QTransform &matrix, GlyphFormat format)
+{
+    Q_UNUSED(pos);
+    int margin = 0;
+    if (format == QFontEngine::Format_A32 || format == QFontEngine::Format_ARGB)
+        margin = glyphMargin(QFontEngine::Format_A32);
+    glyph_metrics_t gm = QFontEngine::boundingBox(glyph, matrix);
+    gm.width += margin * 2;
+    gm.height += margin * 2;
+    return gm;
+}
+
 QT_END_NAMESPACE
 
 #endif // QT_NO_DIRECTWRITE
diff --git a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.h b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.h
index 2addb90de3..e0466c138d 100644
--- a/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.h
+++ b/src/plugins/platforms/windows/qwindowsfontenginedirectwrite.h
@@ -75,6 +75,7 @@ public:
 
     glyph_metrics_t boundingBox(const QGlyphLayout &glyphs);
     glyph_metrics_t boundingBox(glyph_t g);
+    glyph_metrics_t alphaMapBoundingBox(glyph_t glyph, QFixed, const QTransform &matrix, GlyphFormat);
 
     QFixed ascent() const;
     QFixed descent() const;