diff options
| author | Robert Löhning <robert.loehning@qt.io> | 2021-04-06 19:59:48 +0200 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2021-04-09 10:15:11 +0000 |
| commit | 8f2959c345744fb0a9df8755eca682d9137aaffa (patch) | |
| tree | 924f98e967e39120b0c0d33af488e720f27ec2ba /src | |
| parent | 22025bf27de3fabed418e859c0f07b6cfbd5ba2e (diff) | |
QTextHtmlParserNode: Limit colspan to avoid segfault
This fixes oss-fuzz issue 29758.
[ChangeLog][QtGui][Text] QTextDocument::setHtml: column spans are
limited to 20480, an arbitrarily high but reasonable value.
Fixes: QTBUG-92463
Change-Id: Ib759e3e3ac0b0d0d483f8e8ce11002e079db3ace
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
(cherry picked from commit 7473317b52dbc15878d81291faa33f21c20d6ec6)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/gui/text/qtexthtmlparser.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/gui/text/qtexthtmlparser.cpp b/src/gui/text/qtexthtmlparser.cpp index 2326825d47..dee1b249f9 100644 --- a/src/gui/text/qtexthtmlparser.cpp +++ b/src/gui/text/qtexthtmlparser.cpp @@ -1677,7 +1677,7 @@ void QTextHtmlParser::applyAttributes(const QStringList &attributes) node->tableCellRowSpan = qMax(1, node->tableCellRowSpan); } else if (key == QLatin1String("colspan")) { if (setIntAttribute(&node->tableCellColSpan, value)) - node->tableCellColSpan = qMax(1, node->tableCellColSpan); + node->tableCellColSpan = qBound(1, node->tableCellColSpan, 20480); } break; case Html_table: |