Limit Bezier curve subdivision to maximum 512 line segments.

Avoid running out of time and memory for extreme cases.

Task-number: QTBUG-23443
Change-Id: Iac7799097d61295bb7395a2efe48b3e7d9257919
Reviewed-by: Gunnar Sletta <gunnar.sletta@nokia.com>

1 files changed, 16 insertions, 4 deletions

diff --git a/src/gui/painting/qbezier.cpp b/src/gui/painting/qbezier.cpp
index 4305ea8cbc..75a75ead7d 100644
--- a/src/gui/painting/qbezier.cpp
+++ b/src/gui/painting/qbezier.cpp
@@ -190,9 +190,12 @@ static inline bool findInflections(qreal a, qreal b, qreal c,
 
 void QBezier::addToPolygon(QPolygonF *polygon, qreal bezier_flattening_threshold) const
 {
-    QBezier beziers[32];
+    QBezier beziers[10];
+    int levels[10];
     beziers[0] = *this;
+    levels[0] = 9;
     QBezier *b = beziers;
+    int *lvl = levels;
 
     while (b >= beziers) {
         // check if we can pop the top bezier curve from the stack
@@ -208,23 +211,29 @@ void QBezier::addToPolygon(QPolygonF *polygon, qreal bezier_flattening_threshold
                 qAbs(b->x1 - b->x3) + qAbs(b->y1 - b->y3);
             l = 1.;
         }
-        if (d < bezier_flattening_threshold*l || b == beziers + 31) {
+        if (d < bezier_flattening_threshold*l || *lvl == 0) {
             // good enough, we pop it off and add the endpoint
             polygon->append(QPointF(b->x4, b->y4));
             --b;
+            --lvl;
         } else {
             // split, second half of the polygon goes lower into the stack
             b->split(b+1, b);
+            lvl[1] = --lvl[0];
             ++b;
+            ++lvl;
         }
     }
 }
 
 void QBezier::addToPolygon(QDataBuffer<QPointF> &polygon, qreal bezier_flattening_threshold) const
 {
-    QBezier beziers[32];
+    QBezier beziers[10];
+    int levels[10];
     beziers[0] = *this;
+    levels[0] = 9;
     QBezier *b = beziers;
+    int *lvl = levels;
 
     while (b >= beziers) {
         // check if we can pop the top bezier curve from the stack
@@ -240,14 +249,17 @@ void QBezier::addToPolygon(QDataBuffer<QPointF> &polygon, qreal bezier_flattenin
                 qAbs(b->x1 - b->x3) + qAbs(b->y1 - b->y3);
             l = 1.;
         }
-        if (d < bezier_flattening_threshold*l || b == beziers + 31) {
+        if (d < bezier_flattening_threshold*l || *lvl == 0) {
             // good enough, we pop it off and add the endpoint
             polygon.add(QPointF(b->x4, b->y4));
             --b;
+            --lvl;
         } else {
             // split, second half of the polygon goes lower into the stack
             b->split(b+1, b);
+            lvl[1] = --lvl[0];
             ++b;
+            ++lvl;
         }
     }
 }