Fix crash for recursive gradient references

A reference loop with at least three elements would lead to endless
recursion.

Fixes: QTBUG-74189
Change-Id: Ie3c1b32da0e98e9218dc387dd3210666018a92e1
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

2 files changed, 10 insertions, 2 deletions

diff --git a/src/svg/qsvgstyle.cpp b/src/svg/qsvgstyle.cpp
index 5448797..b934f94 100644
--- a/src/svg/qsvgstyle.cpp
+++ b/src/svg/qsvgstyle.cpp
@@ -942,13 +942,20 @@ void QSvgGradientStyle::setStopLink(const QString &link, QSvgTinyDocument *doc)
 
 void QSvgGradientStyle::resolveStops()
 {
+    QStringList visited;
+    resolveStops_helper(&visited);
+}
+
+void QSvgGradientStyle::resolveStops_helper(QStringList *visited)
+{
     if (!m_link.isEmpty() && m_doc) {
         QSvgStyleProperty *prop = m_doc->styleProperty(m_link);
-        if (prop && prop != this) {
+        if (prop && !visited->contains(m_link)) {
+            visited->append(m_link);
             if (prop->type() == QSvgStyleProperty::GRADIENT) {
                 QSvgGradientStyle *st =
                     static_cast<QSvgGradientStyle*>(prop);
-                st->resolveStops();
+                st->resolveStops_helper(visited);
                 m_gradient->setStops(st->qgradient()->stops());
                 m_gradientStopsSet = st->gradientStopsSet();
             }
diff --git a/src/svg/qsvgstyle_p.h b/src/svg/qsvgstyle_p.h
index 916c9fa..39aa690 100644
--- a/src/svg/qsvgstyle_p.h
+++ b/src/svg/qsvgstyle_p.h
@@ -577,6 +577,7 @@ public:
     void setStopLink(const QString &link, QSvgTinyDocument *doc);
     QString stopLink() const { return m_link; }
     void resolveStops();
+    void resolveStops_helper(QStringList *visited);
 
     void setMatrix(const QMatrix &matrix);
     QMatrix  qmatrix() const