From 76eeb072cdffc1a8c776ed01864e6751ccbfba85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20L=C3=B6hning?= Date: Fri, 23 Jul 2021 13:53:47 +0200 Subject: Limit font size to avoid numerous overflows The font size will be passed through a QFixed in QFontEngineBox::ascent() and overflow there as well as in further places. [ChangeLog] Avoid numerous overflows by limiting font size to 0xffff. This fixes oss-fuzz issue 31701. Pick-to: 5.15 6.1 6.2 Change-Id: I2d00c5639804af9b056f0efc979e9899c5358cf7 Reviewed-by: Eirik Aavitsland --- src/svg/qsvghandler.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp index 2ad13b4..f2757bd 100644 --- a/src/svg/qsvghandler.cpp +++ b/src/svg/qsvghandler.cpp @@ -1364,7 +1364,8 @@ static void parseFont(QSvgNode *node, break; case FontSizeValue: { QSvgHandler::LengthType dummy; // should always be pixel size - fontStyle->setSize(parseLength(attributes.fontSize, dummy, handler)); + fontStyle->setSize(qMin(parseLength(attributes.fontSize, dummy, handler), + qreal(0xffff))); } break; default: -- cgit v1.2.1