From 15f74a0f8a41759e1216d52d53852c05c9299107 Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Mon, 1 Apr 2019 14:17:11 +0200 Subject: Fix crash for recursive gradient references A reference loop with at least three elements would lead to endless recursion. Fixes: QTBUG-74189 Change-Id: Ie3c1b32da0e98e9218dc387dd3210666018a92e1 Reviewed-by: Allan Sandfeld Jensen --- src/svg/qsvgstyle.cpp | 11 +++++++++-- src/svg/qsvgstyle_p.h | 1 + 2 files changed, 10 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/svg/qsvgstyle.cpp b/src/svg/qsvgstyle.cpp index 5448797..b934f94 100644 --- a/src/svg/qsvgstyle.cpp +++ b/src/svg/qsvgstyle.cpp @@ -941,14 +941,21 @@ void QSvgGradientStyle::setStopLink(const QString &link, QSvgTinyDocument *doc) } void QSvgGradientStyle::resolveStops() +{ + QStringList visited; + resolveStops_helper(&visited); +} + +void QSvgGradientStyle::resolveStops_helper(QStringList *visited) { if (!m_link.isEmpty() && m_doc) { QSvgStyleProperty *prop = m_doc->styleProperty(m_link); - if (prop && prop != this) { + if (prop && !visited->contains(m_link)) { + visited->append(m_link); if (prop->type() == QSvgStyleProperty::GRADIENT) { QSvgGradientStyle *st = static_cast(prop); - st->resolveStops(); + st->resolveStops_helper(visited); m_gradient->setStops(st->qgradient()->stops()); m_gradientStopsSet = st->gradientStopsSet(); } diff --git a/src/svg/qsvgstyle_p.h b/src/svg/qsvgstyle_p.h index 916c9fa..39aa690 100644 --- a/src/svg/qsvgstyle_p.h +++ b/src/svg/qsvgstyle_p.h @@ -577,6 +577,7 @@ public: void setStopLink(const QString &link, QSvgTinyDocument *doc); QString stopLink() const { return m_link; } void resolveStops(); + void resolveStops_helper(QStringList *visited); void setMatrix(const QMatrix &matrix); QMatrix qmatrix() const -- cgit v1.2.1