summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobert Loehning <robert.loehning@qt.io>2020-08-18 14:41:01 +0200
committerRobert Loehning <robert.loehning@qt.io>2020-08-18 21:58:30 +0200
commit7f1945c5fb492505db9a43853987eaf805291919 (patch)
tree7667c113643ffa1de4e3d6d5cd6053981e841dc9
parentebba0d76654e86b26a63a1310d6b3e859fd16ffe (diff)
downloadqtsvg-7f1945c5fb492505db9a43853987eaf805291919.tar.gz
Fix check against division by zero
The squared values must not be zero. Since both are qreal, this can happen even when neither of them is zero itself. Fixes: oss-fuzz-24738 Pick-to: 5.12 5.15 Change-Id: I61b2bc891e7e3831d4b6ee68b467db28c4f877d4 Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
-rw-r--r--src/svg/qsvghandler.cpp9
-rw-r--r--tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp8
2 files changed, 13 insertions, 4 deletions
diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
index 29f3564..62fe3d3 100644
--- a/src/svg/qsvghandler.cpp
+++ b/src/svg/qsvghandler.cpp
@@ -1496,7 +1496,10 @@ static void pathArc(QPainterPath &path,
qreal y,
qreal curx, qreal cury)
{
- if (!rx || !ry)
+ const qreal Pr1 = rx * rx;
+ const qreal Pr2 = ry * ry;
+
+ if (!Pr1 || !Pr2)
return;
qreal sin_th, cos_th;
@@ -1505,7 +1508,7 @@ static void pathArc(QPainterPath &path,
qreal d, sfactor, sfactor_sq;
qreal th0, th1, th_arc;
int i, n_segs;
- qreal dx, dy, dx1, dy1, Pr1, Pr2, Px, Py, check;
+ qreal dx, dy, dx1, dy1, Px, Py, check;
rx = qAbs(rx);
ry = qAbs(ry);
@@ -1517,8 +1520,6 @@ static void pathArc(QPainterPath &path,
dy = (cury - y) / 2.0;
dx1 = cos_th * dx + sin_th * dy;
dy1 = -sin_th * dx + cos_th * dy;
- Pr1 = rx * rx;
- Pr2 = ry * ry;
Px = dx1 * dx1;
Py = dy1 * dy1;
/* Spec : check if radii are large enough */
diff --git a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
index b348302..ea23d2d 100644
--- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
+++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
@@ -84,6 +84,7 @@ private slots:
void duplicateStyleId();
void oss_fuzz_23731();
void oss_fuzz_24131();
+ void oss_fuzz_24738();
#ifndef QT_NO_COMPRESS
void testGzLoading();
@@ -1624,5 +1625,12 @@ void tst_QSvgRenderer::oss_fuzz_24131()
renderer.render(&painter);
}
+void tst_QSvgRenderer::oss_fuzz_24738()
+{
+ // when configured with "-sanitize undefined", this resulted in:
+ // "runtime error: division by zero"
+ QSvgRenderer().load(QByteArray("<svg><path d=\"a 2 1e-212.....\">"));
+}
+
QTEST_MAIN(tst_QSvgRenderer)
#include "tst_qsvgrenderer.moc"