AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent crash due to giving QWidget::update() a large rect.

Browse Source 
We can simply clip the update rect against the widget's rect and return
if it's empty. Otherwise we risk ending up with update rects that are
larger than INT_MAX due to multiple update rects being merged.

Task-number: QTBUG-30876
Change-Id: I23bd0149fbe8d1a007a60b228e6bddb45dc4fc32
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
Reviewed-by: Gunnar Sletta <gunnar.sletta@digia.com>
This commit is contained in:
Samuel Rødal 2013-04-26 10:36:04 +02:00 committed by The Qt Project
parent 3d42f6fed2
commit a298216bb4
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/widgets/kernel/qwidget.cpp
View File

@ -9874,11 +9874,16 @@ void QWidget::update()
*/
void QWidget::update(const QRect &rect)
{
if (!isVisible() || !updatesEnabled() || rect.isEmpty())
if (!isVisible() || !updatesEnabled())
return;
QRect r = rect & QWidget::rect();
if (r.isEmpty())
return;
if (testAttribute(Qt::WA_WState_InPaintEvent)) {
QApplication::postEvent(this, new QUpdateLaterEvent(rect));
QApplication::postEvent(this, new QUpdateLaterEvent(r));
return;
}
@ -9891,9 +9896,9 @@ void QWidget::update(const QRect &rect)
#endif // Q_WS_MAC
QTLWExtra *tlwExtra = window()->d_func()->maybeTopData();
if (tlwExtra && !tlwExtra->inTopLevelResize && tlwExtra->backingStore)
tlwExtra->backingStoreTracker->markDirty(rect, this);
tlwExtra->backingStoreTracker->markDirty(r, this);
} else {
d_func()->repaint_sys(rect);
d_func()->repaint_sys(r);
}
}