diff options
| author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2021-01-26 17:29:08 +0100 |
|---|---|---|
| committer | Qt Cherry-pick Bot <cherrypick_bot@qt-project.org> | 2021-02-03 11:31:48 +0000 |
| commit | a454a5628a50afdb1c968a52685055772dcbd3e5 (patch) | |
| tree | a25e6610ddaf51f46d0cae7d4b23d9d01574de8e /src | |
| parent | 41830b812e5883ff7b98fa1f5779df4648738829 (diff) | |
Avoid overflow in text layout
Fixes oss-fuzz issue 29313.
Change-Id: Idbabd162fa9e0dbce687981bdbcc75be37189a61
Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
Reviewed-by: Robert Löhning <robert.loehning@qt.io>
(cherry picked from commit bfc09b8d8fa6c1a397aff458c644ed424754adf0)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/gui/text/qtextlayout.cpp | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp index 29e9ebb4af..2c08ed648b 100644 --- a/src/gui/text/qtextlayout.cpp +++ b/src/gui/text/qtextlayout.cpp @@ -850,6 +850,10 @@ QTextLine QTextLayout::createLine() int l = d->lines.size(); if (l && d->lines.at(l-1).length < 0) { QTextLine(l-1, d).setNumColumns(INT_MAX); + if (d->maxWidth > QFIXED_MAX / 2) { + qWarning("QTextLayout: text too long, truncated."); + return QTextLine(); + } } int from = l > 0 ? d->lines.at(l-1).from + d->lines.at(l-1).length + d->lines.at(l-1).trailingSpaces : 0; int strlen = d->layoutData->string.length(); |