QStyle: Fix overflows and crash when converting slider positions

Qt Creator crashes when max is INT_MAX and min is -1, see bugreport.

Change-Id: I441e76c0ff87052083ed3d77e6085b186402e5d8
Fixes: QTBUG-101581
Pick-to: 6.2 6.3
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>

1 files changed, 7 insertions, 7 deletions

diff --git a/src/widgets/styles/qstyle.cpp b/src/widgets/styles/qstyle.cpp
index 9301141c07..827f51a7d9 100644
--- a/src/widgets/styles/qstyle.cpp
+++ b/src/widgets/styles/qstyle.cpp
@@ -2262,8 +2262,8 @@ int QStyle::sliderPositionFromValue(int min, int max, int logicalValue, int span
     if (logicalValue > max)
         return upsideDown ? span : min;
 
-    uint range = max - min;
-    uint p = upsideDown ? max - logicalValue : logicalValue - min;
+    const uint range = qint64(max) - min;
+    const uint p = upsideDown ? qint64(max) - logicalValue : qint64(logicalValue) - min;
 
     if (range > (uint)INT_MAX/4096) {
         double dpos = (double(p))/(double(range)/span);
@@ -2305,15 +2305,15 @@ int QStyle::sliderValueFromPosition(int min, int max, int pos, int span, bool up
     if (pos >= span)
         return upsideDown ? min : max;
 
-    uint range = max - min;
+    const qint64 range = qint64(max) - min;
 
     if ((uint)span > range) {
-        int tmp = (2 * pos * range + span) / (2 * span);
+        const int tmp = (2 * range * pos + span) / (qint64(2) * span);
         return upsideDown ? max - tmp : tmp + min;
     } else {
-        uint div = range / span;
-        uint mod = range % span;
-        int tmp = pos * div + (2 * pos * mod + span) / (2 * span);
+        const qint64 div = range / span;
+        const qint64 mod = range % span;
+        const int tmp = pos * div + (2 * mod * pos + span) / (qint64(2) * span);
         return upsideDown ? max - tmp : tmp + min;
     }
     // equiv. to min + (pos*range)/span + 0.5