Fix crash in the declarative contact model

Make sure we don't try to move contacts to an invalid index when
updating the contacts.
This change protects against moving contacts, in the declarative contact
model, to an invalid index. In most cases this will never happen, but
if the pending contacts list contains duplicates, then  it's possible
that the index, used to move existing contacts, is out of range.
The worst case scenario with this change, is that a contact will be
moved more then once, that is, once for each duplicate.

Change-Id: I567ea5d9a195819550c98b0da9f45aa613cb3a79
Reviewed-by: Renato Araujo Oliveira Filho <renato.filho@canonical.com>
Reviewed-by: Christopher Adams <chris.adams@jollamobile.com>

1 files changed, 7 insertions, 4 deletions

diff --git a/src/imports/contacts/qdeclarativecontactmodel.cpp b/src/imports/contacts/qdeclarativecontactmodel.cpp
index 8a659bf9b..d736362d5 100644
--- a/src/imports/contacts/qdeclarativecontactmodel.cpp
+++ b/src/imports/contacts/qdeclarativecontactmodel.cpp
@@ -1065,10 +1065,13 @@ void QDeclarativeContactModel::fetchRequestStateChanged(QContactAbstractRequest:
                 } else {
                     QDeclarativeContact *contact = d->m_contactMap[c.id()];
 
-                    int pos = d->m_contacts.indexOf(contact);
-                    if (pos != i) {
-                        beginMoveRows(QModelIndex(), pos, pos, QModelIndex(), i);
-                        d->m_contacts.move(pos, i);
+                    // If there are duplicates in the pending contacts list, then the current index
+                    // can be outside this contact lists range and we need to adjust it to avoid crashing.
+                    const int oldIdx = d->m_contacts.indexOf(contact);
+                    const int newIdx = i < d->m_contacts.size() ? i : d->m_contacts.size() - 1;
+                    if (oldIdx != newIdx) {
+                        beginMoveRows(QModelIndex(), oldIdx, oldIdx, QModelIndex(), newIdx);
+                        d->m_contacts.move(oldIdx, newIdx);
                         endMoveRows();
                     }
                 }