From d6c4a3edf9adb02b6f96d43768db9f90a6623de7 Mon Sep 17 00:00:00 2001 From: Eskil Abrahamsen Blomfeldt Date: Fri, 11 Feb 2022 14:09:25 +0100 Subject: Fix integer overflow for broken QPainterPaths With some bogus input, we can end up with NaN in the bounding rects of the control points. This in turn causes problems later when it is converted to ints and used in code. To avoid it, we exit early if the rect is invalid (negative or NaN size). Pick-to: 5.15 6.2 6.3 Fixes: QTBUG-100217 Change-Id: Idbc6700b85cb30198d69fedbf8f3be3e1ab65e40 Reviewed-by: Lars Knoll --- src/gui/painting/qpaintengine_raster.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/gui/painting/qpaintengine_raster.cpp') diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp index 3bd3a81353..b044b485df 100644 --- a/src/gui/painting/qpaintengine_raster.cpp +++ b/src/gui/painting/qpaintengine_raster.cpp @@ -1725,7 +1725,7 @@ void QRasterPaintEngine::fill(const QVectorPath &path, const QBrush &brush) QRectF cpRect = path.controlPointRect(); const QRectF pathDeviceRect = s->matrix.mapRect(cpRect); // Skip paths that by conservative estimates are completely outside the paint device. - if (!pathDeviceRect.intersects(QRectF(d->deviceRect))) + if (!pathDeviceRect.intersects(QRectF(d->deviceRect)) || !pathDeviceRect.isValid()) return; ProcessSpans blend = d->getBrushFunc(pathDeviceRect, &s->brushData); -- cgit v1.2.3