From 7f1945c5fb492505db9a43853987eaf805291919 Mon Sep 17 00:00:00 2001
From: Robert Loehning <robert.loehning@qt.io>
Date: Tue, 18 Aug 2020 14:41:01 +0200
Subject: Fix check against division by zero

The squared values must not be zero. Since both are qreal,
this can happen even when neither of them is zero itself.

Fixes: oss-fuzz-24738
Pick-to: 5.12 5.15
Change-Id: I61b2bc891e7e3831d4b6ee68b467db28c4f877d4
Reviewed-by: Thiago Macieira <thiago.macieira@intel.com>
---
 src/svg/qsvghandler.cpp                      | 9 +++++----
 tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp | 8 ++++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
index 29f3564..62fe3d3 100644
--- a/src/svg/qsvghandler.cpp
+++ b/src/svg/qsvghandler.cpp
@@ -1496,7 +1496,10 @@ static void pathArc(QPainterPath &path,
                     qreal               y,
                     qreal curx, qreal cury)
 {
-    if (!rx || !ry)
+    const qreal Pr1 = rx * rx;
+    const qreal Pr2 = ry * ry;
+
+    if (!Pr1 || !Pr2)
         return;
 
     qreal sin_th, cos_th;
@@ -1505,7 +1508,7 @@ static void pathArc(QPainterPath &path,
     qreal d, sfactor, sfactor_sq;
     qreal th0, th1, th_arc;
     int i, n_segs;
-    qreal dx, dy, dx1, dy1, Pr1, Pr2, Px, Py, check;
+    qreal dx, dy, dx1, dy1, Px, Py, check;
 
     rx = qAbs(rx);
     ry = qAbs(ry);
@@ -1517,8 +1520,6 @@ static void pathArc(QPainterPath &path,
     dy = (cury - y) / 2.0;
     dx1 =  cos_th * dx + sin_th * dy;
     dy1 = -sin_th * dx + cos_th * dy;
-    Pr1 = rx * rx;
-    Pr2 = ry * ry;
     Px = dx1 * dx1;
     Py = dy1 * dy1;
     /* Spec : check if radii are large enough */
diff --git a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
index b348302..ea23d2d 100644
--- a/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
+++ b/tests/auto/qsvgrenderer/tst_qsvgrenderer.cpp
@@ -84,6 +84,7 @@ private slots:
     void duplicateStyleId();
     void oss_fuzz_23731();
     void oss_fuzz_24131();
+    void oss_fuzz_24738();
 
 #ifndef QT_NO_COMPRESS
     void testGzLoading();
@@ -1624,5 +1625,12 @@ void tst_QSvgRenderer::oss_fuzz_24131()
     renderer.render(&painter);
 }
 
+void tst_QSvgRenderer::oss_fuzz_24738()
+{
+    // when configured with "-sanitize undefined", this resulted in:
+    // "runtime error: division by zero"
+    QSvgRenderer().load(QByteArray("<svg><path d=\"a 2 1e-212.....\">"));
+}
+
 QTEST_MAIN(tst_QSvgRenderer)
 #include "tst_qsvgrenderer.moc"
-- 
cgit v1.2.1