diff options
author | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-02-28 11:20:27 +0100 |
---|---|---|
committer | Allan Sandfeld Jensen <allan.jensen@qt.io> | 2019-03-04 09:05:30 +0000 |
commit | 6f152f87dbbd47acc58458d636ce5d1cc181b8fd (patch) | |
tree | 6ddeebfb1078c205cba8a86c315e2e961e1b6b0e /tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp | |
parent | f354d4be9a7a436fb16bd9764a261c930101850c (diff) | |
download | qtsvg-6f152f87dbbd47acc58458d636ce5d1cc181b8fd.tar.gz |
Fix IRI parsing, and use after free
Make the parsing of IRI references tighter, and avoid freeing
styles when inserting a duplicate id.
Fixes: QTBUG-74104
Change-Id: I3a12fcf09ce1c55c135a4209817413ed8af75dec
Reviewed-by: Robert Loehning <robert.loehning@qt.io>
Reviewed-by: Eirik Aavitsland <eirik.aavitsland@qt.io>
Diffstat (limited to 'tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp')
-rw-r--r-- | tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp | 39 |
1 files changed, 29 insertions, 10 deletions
diff --git a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp index 553838e..5b359b9 100644 --- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp +++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp @@ -77,6 +77,7 @@ private slots: void testUseElement(); void smallFont(); void styleSheet(); + void duplicateStyleId(); #ifndef QT_NO_COMPRESS void testGzLoading(); @@ -139,22 +140,28 @@ void tst_QSvgRenderer::invalidUrl_data() { QTest::addColumn<QByteArray>("svg"); - QTest::newRow("00") << QByteArray("<svg><circle fill=\"url\" /></svg>"); - QTest::newRow("01") << QByteArray("<svg><circle fill=\"url0\" /></svg>"); - QTest::newRow("02") << QByteArray("<svg><circle fill=\"url(0\" /></svg>"); - QTest::newRow("03") << QByteArray("<svg><circle fill=\"url (0\" /></svg>"); - QTest::newRow("04") << QByteArray("<svg><circle fill=\"url ( 0\" /></svg>"); - QTest::newRow("05") << QByteArray("<svg><circle fill=\"url#\" /></svg>"); - QTest::newRow("06") << QByteArray("<svg><circle fill=\"url#(\" /></svg>"); - QTest::newRow("07") << QByteArray("<svg><circle fill=\"url(#\" /></svg>"); - QTest::newRow("08") << QByteArray("<svg><circle fill=\"url(# \" /></svg>"); - QTest::newRow("09") << QByteArray("<svg><circle fill=\"url(# 0\" /></svg>"); + QTest::newRow("01") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url0\" /></svg>"); + QTest::newRow("02") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url(0\" /></svg>"); + QTest::newRow("03") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url (0\" /></svg>"); + QTest::newRow("04") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url ( 0\" /></svg>"); + QTest::newRow("05") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url#\" /></svg>"); + QTest::newRow("06") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url#(\" /></svg>"); + QTest::newRow("07") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url(#\" /></svg>"); + QTest::newRow("08") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url(# \" /></svg>"); + QTest::newRow("09") << QByteArray("<svg><linearGradient id=\"0\"/><circle fill=\"url(# 0\" /></svg>"); + QTest::newRow("10") << QByteArray("<svg><linearGradient id=\"blabla\"/><circle fill=\"urlblabla\" /></svg>"); + QTest::newRow("11") << QByteArray("<svg><linearGradient id=\"blabla\"/><circle fill=\"url(blabla\" /></svg>"); + QTest::newRow("12") << QByteArray("<svg><linearGradient id=\"blabla\"/><circle fill=\"url(blabla)\" /></svg>"); + QTest::newRow("13") << QByteArray("<svg><linearGradient id=\"blabla\"/><circle fill=\"url(#blabla\" /></svg>"); } void tst_QSvgRenderer::invalidUrl() { QFETCH(QByteArray, svg); +#if QT_CONFIG(regularexpression) + QTest::ignoreMessage(QtWarningMsg, QRegularExpression("Could not resolve property")); +#endif QSvgRenderer renderer(svg); QVERIFY(renderer.isValid()); } @@ -1459,5 +1466,17 @@ void tst_QSvgRenderer::styleSheet() QCOMPARE(images[0], images[1]); } +void tst_QSvgRenderer::duplicateStyleId() +{ + QByteArray svg = QByteArrayLiteral("<svg><linearGradient id=\"a\"/>" + "<rect style=\"fill:url(#a)\"/>" + "<linearGradient id=\"a\"/></svg>"); + QTest::ignoreMessage(QtWarningMsg, "Duplicate unique style id: \"a\""); + QImage image(200, 200, QImage::Format_RGB32); + QPainter painter(&image); + QSvgRenderer renderer(svg); + renderer.render(&painter); +} + QTEST_MAIN(tst_QSvgRenderer) #include "tst_qsvgrenderer.moc" |