diff options
| author | Robert Löhning <robert.loehning@qt.io> | 2021-07-23 13:53:47 +0200 |
|---|---|---|
| committer | Robert Löhning <robert.loehning@qt.io> | 2021-07-27 16:06:41 +0200 |
| commit | 76eeb072cdffc1a8c776ed01864e6751ccbfba85 (patch) | |
| tree | 6531985a03e7c79822a58736be2701a41915ecde /src | |
| parent | 0d6b3f34eadfbde3927d045aae21966b1b8c9a74 (diff) | |
| download | qtsvg-76eeb072cdffc1a8c776ed01864e6751ccbfba85.tar.gz | |
Limit font size to avoid numerous overflows
The font size will be passed through a QFixed in
QFontEngineBox::ascent() and overflow there as well as in further places.
[ChangeLog] Avoid numerous overflows by limiting font size to 0xffff.
This fixes oss-fuzz issue 31701.
Pick-to: 5.15 6.1 6.2
Change-Id: I2d00c5639804af9b056f0efc979e9899c5358cf7
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'src')
| -rw-r--r-- | src/svg/qsvghandler.cpp | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp index 2ad13b4..f2757bd 100644 --- a/src/svg/qsvghandler.cpp +++ b/src/svg/qsvghandler.cpp @@ -1364,7 +1364,8 @@ static void parseFont(QSvgNode *node, break; case FontSizeValue: { QSvgHandler::LengthType dummy; // should always be pixel size - fontStyle->setSize(parseLength(attributes.fontSize, dummy, handler)); + fontStyle->setSize(qMin(parseLength(attributes.fontSize, dummy, handler), + qreal(0xffff))); } break; default: |