summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorQt Forward Merge Bot <qt_forward_merge_bot@qt-project.org>2019-04-17 10:37:46 +0200
committerQt Forward Merge Bot <qt_forward_merge_bot@qt-project.org>2019-04-17 10:37:46 +0200
commit99218c5fc00d6124fdcef1a3e1954e658d10db28 (patch)
tree1891cc34fabc325b772d84ae99839aea72eb5605
parent11c985829493f3aed8e7894e5f9fdd44891ec249 (diff)
parentfd12ae24b4542cf2f0df1a34187c4b8c0a408e01 (diff)
downloadqtsvg-99218c5fc00d6124fdcef1a3e1954e658d10db28.tar.gz
Merge remote-tracking branch 'origin/5.12.3' into 5.12
Change-Id: I73662000d1b52a4b61a9bd0a58af2fb9a7dc7b22
-rw-r--r--dist/changes-5.12.322
-rw-r--r--src/svg/qsvgstyle.cpp11
-rw-r--r--src/svg/qsvgstyle_p.h1
-rw-r--r--tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp39
4 files changed, 71 insertions, 2 deletions
diff --git a/dist/changes-5.12.3 b/dist/changes-5.12.3
new file mode 100644
index 0000000..f5b447f
--- /dev/null
+++ b/dist/changes-5.12.3
@@ -0,0 +1,22 @@
+Qt 5.12.3 is a bug-fix release. It maintains both forward and backward
+compatibility (source and binary) with Qt 5.12.0 through 5.12.2.
+
+For more details, refer to the online documentation included in this
+distribution. The documentation is also available online:
+
+https://doc.qt.io/qt-5/index.html
+
+The Qt version 5.12 series is binary compatible with the 5.11.x series.
+Applications compiled for 5.11 will continue to run with 5.12.
+
+Some of the changes listed in this file include issue tracking numbers
+corresponding to tasks in the Qt Bug Tracker:
+
+https://bugreports.qt.io/
+
+Each of these identifiers can be entered in the bug tracker to obtain more
+information about a particular change.
+
+ - [QTBUG-74083] Fixed leak on parsing failure.
+ - [QTBUG-74129] Fixed possible heap overflow in path parsing.
+ - [QTBUG-74189] Fixed crash with recursive gradient references.
diff --git a/src/svg/qsvgstyle.cpp b/src/svg/qsvgstyle.cpp
index 5448797..b934f94 100644
--- a/src/svg/qsvgstyle.cpp
+++ b/src/svg/qsvgstyle.cpp
@@ -942,13 +942,20 @@ void QSvgGradientStyle::setStopLink(const QString &link, QSvgTinyDocument *doc)
void QSvgGradientStyle::resolveStops()
{
+ QStringList visited;
+ resolveStops_helper(&visited);
+}
+
+void QSvgGradientStyle::resolveStops_helper(QStringList *visited)
+{
if (!m_link.isEmpty() && m_doc) {
QSvgStyleProperty *prop = m_doc->styleProperty(m_link);
- if (prop && prop != this) {
+ if (prop && !visited->contains(m_link)) {
+ visited->append(m_link);
if (prop->type() == QSvgStyleProperty::GRADIENT) {
QSvgGradientStyle *st =
static_cast<QSvgGradientStyle*>(prop);
- st->resolveStops();
+ st->resolveStops_helper(visited);
m_gradient->setStops(st->qgradient()->stops());
m_gradientStopsSet = st->gradientStopsSet();
}
diff --git a/src/svg/qsvgstyle_p.h b/src/svg/qsvgstyle_p.h
index 916c9fa..39aa690 100644
--- a/src/svg/qsvgstyle_p.h
+++ b/src/svg/qsvgstyle_p.h
@@ -577,6 +577,7 @@ public:
void setStopLink(const QString &link, QSvgTinyDocument *doc);
QString stopLink() const { return m_link; }
void resolveStops();
+ void resolveStops_helper(QStringList *visited);
void setMatrix(const QMatrix &matrix);
QMatrix qmatrix() const
diff --git a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
index 5b359b9..aa28ca9 100644
--- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
+++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
@@ -67,6 +67,8 @@ private slots:
void boundsOnElement() const;
void gradientStops() const;
void gradientRefs();
+ void recursiveRefs_data();
+ void recursiveRefs();
void fillRule();
void opacity();
void paths();
@@ -674,6 +676,43 @@ void tst_QSvgRenderer::gradientRefs()
}
}
+void tst_QSvgRenderer::recursiveRefs_data()
+{
+ QTest::addColumn<QByteArray>("svg");
+
+ QTest::newRow("single") << QByteArray("<svg>"
+ "<linearGradient id='0' xlink:href='#0'/>"
+ "<rect x='0' y='0' width='20' height='20' fill='url(#0)'/>"
+ "</svg>");
+
+ QTest::newRow("double") << QByteArray("<svg>"
+ "<linearGradient id='0' xlink:href='#1'/>"
+ "<linearGradient id='1' xlink:href='#0'/>"
+ "<rect x='0' y='0' width='20' height='20' fill='url(#0)'/>"
+ "</svg>");
+
+ QTest::newRow("triple") << QByteArray("<svg>"
+ "<linearGradient id='0' xlink:href='#1'/>"
+ "<linearGradient id='1' xlink:href='#2'/>"
+ "<linearGradient id='2' xlink:href='#0'/>"
+ "<rect x='0' y='0' width='20' height='20' fill='url(#0)'/>"
+ "</svg>");
+}
+
+void tst_QSvgRenderer::recursiveRefs()
+{
+ QFETCH(QByteArray, svg);
+
+ QImage image(20, 20, QImage::Format_ARGB32_Premultiplied);
+ image.fill(Qt::green);
+ QImage refImage = image.copy();
+
+ QSvgRenderer renderer(svg);
+ QPainter painter(&image);
+ renderer.render(&painter);
+ QCOMPARE(image, refImage);
+}
+
#ifndef QT_NO_COMPRESS
void tst_QSvgRenderer::testGzLoading()