AuroraMiddleware/qt5base-lts
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix get out of bounds index in QSortFilterProxyModel::filterAcceptsRow

Browse Source 
Before calling the index function, we need to check the validity of the parameters.

Fixes: QTBUG-91878
Pick-to: 5.15 6.0 6.1
Change-Id: I9ec7265fff3f81b8a288c4ba8fae606a2ec808a6
Reviewed-by: David Faure <david.faure@kdab.com>
This commit is contained in:
ChunLin Wang 2021-03-31 17:54:49 +08:00
parent c10159a9a1
commit b8802071ed
2 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/corelib/itemmodels/qsortfilterproxymodel.cpp
View File

@ -3001,8 +3001,9 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
if (d->filter_data.pattern().isEmpty())
return true;
int column_count = d->model->columnCount(source_parent);
if (d->filter_column == -1) {
int column_count = d->model->columnCount(source_parent);
for (int column = 0; column < column_count; ++column) {
QModelIndex source_index = d->model->index(source_row, column, source_parent);
QString key = d->model->data(source_index, d->filter_role).toString();
@ -3011,9 +3012,10 @@ bool QSortFilterProxyModel::filterAcceptsRow(int source_row, const QModelIndex &
}
return false;
}
QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
if (!source_index.isValid()) // the column may not exist
if (d->filter_column >= column_count) // the column may not exist
return true;
QModelIndex source_index = d->model->index(source_row, d->filter_column, source_parent);
QString key = d->model->data(source_index, d->filter_role).toString();
return d->filter_data.match(key).hasMatch();
}

17
tests/auto/corelib/itemmodels/qconcatenatetablesproxymodel/tst_qconcatenatetablesproxymodel.cpp
View File

@ -117,6 +117,7 @@ private Q_SLOTS:
void shouldPropagateDropAfterLastRow_data();
void shouldPropagateDropAfterLastRow();
void qtbug91788();
void qtbug91878();
private:
QStandardItemModel mod;
@ -843,6 +844,22 @@ void tst_QConcatenateTablesProxyModel::qtbug91788()
QCOMPARE(proxyConcat.columnCount(), 0);
}
void tst_QConcatenateTablesProxyModel::qtbug91878()
{
QStandardItemModel m;
m.setRowCount(4);
m.setColumnCount(4);
QConcatenateTablesProxyModel pm;
QSortFilterProxyModel proxyFilter;
proxyFilter.setSourceModel(&pm);
proxyFilter.setFilterFixedString("something");
pm.addSourceModel(&m); // This should not assert
QCOMPARE(pm.columnCount(), 4);
QCOMPARE(pm.rowCount(), 4);
}
QTEST_GUILESS_MAIN(tst_QConcatenateTablesProxyModel)
#include "tst_qconcatenatetablesproxymodel.moc"