diff options
| author | Harald Brinkmann <Harald.Brinkmann@detectomat.com> | 2018-03-27 09:45:03 +0200 |
|---|---|---|
| committer | Jan Arve Sæther <jan-arve.saether@qt.io> | 2018-04-05 08:58:48 +0000 |
| commit | c067083057274a6736836125952351d8b467924e (patch) | |
| tree | da919bcf63f1d02d18f2c28b55cc6204256d4772 /src/widgets | |
| parent | 18a1cfaba3625b41643d9c03ddc304d2d377b590 (diff) | |
Fix memory corruption in heightForWidth cache
Overflowing q_firstCachedHfw caused memory to be overwritten
before q_cachedHfws.
Change-Id: Ibbcc72380f426550cc0569a05c54cd1acd878b33
Reviewed-by: Jan Arve Sæther <jan-arve.saether@qt.io>
Diffstat (limited to 'src/widgets')
| -rw-r--r-- | src/widgets/kernel/qlayoutitem.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/widgets/kernel/qlayoutitem.cpp b/src/widgets/kernel/qlayoutitem.cpp index 5c4fc20687..52640daf55 100644 --- a/src/widgets/kernel/qlayoutitem.cpp +++ b/src/widgets/kernel/qlayoutitem.cpp @@ -839,7 +839,7 @@ int QWidgetItemV2::heightForWidth(int width) const const QSize &size = q_cachedHfws[offset % HfwCacheMaxSize]; if (size.width() == width) { if (q_hfwCacheSize == HfwCacheMaxSize) - q_firstCachedHfw = offset; + q_firstCachedHfw = offset % HfwCacheMaxSize; return size.height(); } } |