From 6292c75fb742f2877630ec22fb3a9b0d3afc9a96 Mon Sep 17 00:00:00 2001
From: Allan Sandfeld Jensen <allan.jensen@qt.io>
Date: Fri, 1 Mar 2019 16:08:34 +0100
Subject: Fix stack overflow on indirect self-referral

Change-Id: If2b13c3dc4a09ce6d18aff97855179172f92878b
Reviewed-by: Edward Welbourne <edward.welbourne@qt.io>
---
 src/svg/qsvggraphics.cpp | 23 ++++++++++++++---------
 src/svg/qsvggraphics_p.h |  1 +
 2 files changed, 15 insertions(+), 9 deletions(-)

(limited to 'src')

diff --git a/src/svg/qsvggraphics.cpp b/src/svg/qsvggraphics.cpp
index 12f2349..bcd2452 100644
--- a/src/svg/qsvggraphics.cpp
+++ b/src/svg/qsvggraphics.cpp
@@ -41,11 +41,12 @@
 
 #include "qsvgfont_p.h"
 
-#include "qpainter.h"
-#include "qtextdocument.h"
-#include "qabstracttextdocumentlayout.h"
-#include "qtextcursor.h"
-#include "qdebug.h"
+#include <qabstracttextdocumentlayout.h>
+#include <qdebug.h>
+#include <qpainter.h>
+#include <qscopedvaluerollback.h>
+#include <qtextcursor.h>
+#include <qtextdocument.h>
 
 #include <math.h>
 #include <limits.h>
@@ -458,14 +459,14 @@ void QSvgText::addText(const QString &text)
 }
 
 QSvgUse::QSvgUse(const QPointF &start, QSvgNode *parent, QSvgNode *node)
-    : QSvgNode(parent), m_link(node), m_start(start)
+    : QSvgNode(parent), m_link(node), m_start(start), m_recursing(false)
 {
 
 }
 
 void QSvgUse::draw(QPainter *p, QSvgExtraStates &states)
 {
-    if (Q_UNLIKELY(!m_link || isDescendantOf(m_link)))
+    if (Q_UNLIKELY(!m_link || isDescendantOf(m_link) || m_recursing))
         return;
 
     applyStyle(p, states);
@@ -473,7 +474,10 @@ void QSvgUse::draw(QPainter *p, QSvgExtraStates &states)
     if (!m_start.isNull()) {
         p->translate(m_start);
     }
-    m_link->draw(p, states);
+    {
+        QScopedValueRollback<bool> guard(m_recursing, true);
+        m_link->draw(p, states);
+    }
     if (!m_start.isNull()) {
         p->translate(-m_start);
     }
@@ -556,7 +560,8 @@ QSvgNode::Type QSvgVideo::type() const
 QRectF QSvgUse::bounds(QPainter *p, QSvgExtraStates &states) const
 {
     QRectF bounds;
-    if (Q_LIKELY(m_link && !isDescendantOf(m_link))) {
+    if (Q_LIKELY(m_link && !isDescendantOf(m_link) && !m_recursing)) {
+        QScopedValueRollback<bool> guard(m_recursing, true);
         p->translate(m_start);
         bounds = m_link->transformedBounds(p, states);
         p->translate(-m_start);
diff --git a/src/svg/qsvggraphics_p.h b/src/svg/qsvggraphics_p.h
index 1138d1a..8488b33 100644
--- a/src/svg/qsvggraphics_p.h
+++ b/src/svg/qsvggraphics_p.h
@@ -251,6 +251,7 @@ private:
     QSvgNode *m_link;
     QPointF   m_start;
     QString   m_linkId;
+    mutable bool m_recursing;
 };
 
 class QSvgVideo : public QSvgNode
-- 
cgit v1.2.1