diff options
| author | Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io> | 2022-02-11 14:09:25 +0100 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2022-02-15 09:16:30 +0000 |
| commit | d519901ddbc83ae543a08fd378d23305ed09afe7 (patch) | |
| tree | 845ab41e3aab46bdc96fcdce7e9ff316a4a9a874 /src | |
| parent | 8ba70a3be84dcefa8cdb24d706263363eea4c827 (diff) | |
Fix integer overflow for broken QPainterPaths
With some bogus input, we can end up with NaN in the
bounding rects of the control points. This in turn
causes problems later when it is converted to ints
and used in code. To avoid it, we exit early if the
rect is invalid (negative or NaN size).
Fixes: QTBUG-100217
Change-Id: Idbc6700b85cb30198d69fedbf8f3be3e1ab65e40
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit d6c4a3edf9adb02b6f96d43768db9f90a6623de7)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/gui/painting/qpaintengine_raster.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp index cd6c860120..cb3c0c4a6a 100644 --- a/src/gui/painting/qpaintengine_raster.cpp +++ b/src/gui/painting/qpaintengine_raster.cpp @@ -1723,7 +1723,7 @@ void QRasterPaintEngine::fill(const QVectorPath &path, const QBrush &brush) QRectF cpRect = path.controlPointRect(); const QRectF pathDeviceRect = s->matrix.mapRect(cpRect); // Skip paths that by conservative estimates are completely outside the paint device. - if (!pathDeviceRect.intersects(QRectF(d->deviceRect))) + if (!pathDeviceRect.intersects(QRectF(d->deviceRect)) || !pathDeviceRect.isValid()) return; ProcessSpans blend = d->getBrushFunc(pathDeviceRect, &s->brushData); |