From 8c199714e9bc638fb3f6ec747fb7a23373e49335 Mon Sep 17 00:00:00 2001 From: Eirik Aavitsland Date: Mon, 9 Jul 2018 10:45:22 +0200 Subject: Fix crash when parsing malformed url reference The parsing did not check for end of input. Change-Id: I56a478877d242146395977b767511425d2b8ced1 Reviewed-by: Lars Knoll --- src/svg/qsvghandler.cpp | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'src') diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp index 6d2e279..fe07d0e 100644 --- a/src/svg/qsvghandler.cpp +++ b/src/svg/qsvghandler.cpp @@ -774,16 +774,17 @@ static QVector parsePercentageList(const QChar *&str) static QString idFromUrl(const QString &url) { QString::const_iterator itr = url.constBegin(); - while ((*itr).isSpace()) + QString::const_iterator end = url.constEnd(); + while (itr != end && (*itr).isSpace()) ++itr; - if ((*itr) == QLatin1Char('(')) + if (itr != end && (*itr) == QLatin1Char('(')) ++itr; - while ((*itr).isSpace()) + while (itr != end && (*itr).isSpace()) ++itr; - if ((*itr) == QLatin1Char('#')) + if (itr != end && (*itr) == QLatin1Char('#')) ++itr; QString id; - while ((*itr) != QLatin1Char(')')) { + while (itr != end && (*itr) != QLatin1Char(')')) { id += *itr; ++itr; } -- cgit v1.2.1