65 lines
2.2 KiB
Diff
65 lines
2.2 KiB
Diff
|
From 9e92024a183e93c63cb96a0a48cca07c20c7a243 Mon Sep 17 00:00:00 2001
|
||
|
|
From: starlet-dx <15929766099@163.com>
|
||
|
|
Date: Wed, 28 Jun 2023 11:47:13 +0800
|
||
|
|
Subject: [PATCH 1/1] Fix CVE-2023-32763
|
||
|
|
|
||
|
|
Origin: https://download.qt.io/official_releases/qt/5.15/CVE-2023-32763-qtbase-5.15.diff
|
||
|
|
|
||
|
|
---
|
||
|
|
src/gui/painting/qfixed_p.h | 9 +++++++++
|
||
|
|
src/gui/text/qtextlayout.cpp | 9 ++++++---
|
||
|
|
2 files changed, 15 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/gui/painting/qfixed_p.h b/src/gui/painting/qfixed_p.h
|
||
|
|
index 84659288..57d750a4 100644
|
||
|
|
--- a/src/gui/painting/qfixed_p.h
|
||
|
|
+++ b/src/gui/painting/qfixed_p.h
|
||
|
|
@@ -54,6 +54,7 @@
|
||
|
|
#include <QtGui/private/qtguiglobal_p.h>
|
||
|
|
#include "QtCore/qdebug.h"
|
||
|
|
#include "QtCore/qpoint.h"
|
||
|
|
+#include <QtCore/private/qnumeric_p.h>
|
||
|
|
#include "QtCore/qsize.h"
|
||
|
|
|
||
|
|
QT_BEGIN_NAMESPACE
|
||
|
|
@@ -182,6 +183,14 @@ Q_DECL_CONSTEXPR inline bool operator<(int i, const QFixed &f) { return i * 64 <
|
||
|
|
Q_DECL_CONSTEXPR inline bool operator>(const QFixed &f, int i) { return f.value() > i * 64; }
|
||
|
|
Q_DECL_CONSTEXPR inline bool operator>(int i, const QFixed &f) { return i * 64 > f.value(); }
|
||
|
|
|
||
|
|
+inline bool qAddOverflow(QFixed v1, QFixed v2, QFixed *r)
|
||
|
|
+{
|
||
|
|
+ int val;
|
||
|
|
+ bool result = add_overflow(v1.value(), v2.value(), &val);
|
||
|
|
+ r->setValue(val);
|
||
|
|
+ return result;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
#ifndef QT_NO_DEBUG_STREAM
|
||
|
|
inline QDebug &operator<<(QDebug &dbg, const QFixed &f)
|
||
|
|
{ return dbg << f.toReal(); }
|
||
|
|
diff --git a/src/gui/text/qtextlayout.cpp b/src/gui/text/qtextlayout.cpp
|
||
|
|
index b2f12ef1..897a1bc9 100644
|
||
|
|
--- a/src/gui/text/qtextlayout.cpp
|
||
|
|
+++ b/src/gui/text/qtextlayout.cpp
|
||
|
|
@@ -2138,11 +2138,14 @@ found:
|
||
|
|
eng->maxWidth = qMax(eng->maxWidth, line.textWidth);
|
||
|
|
} else {
|
||
|
|
eng->minWidth = qMax(eng->minWidth, lbh.minw);
|
||
|
|
- eng->maxWidth += line.textWidth;
|
||
|
|
+ if (qAddOverflow(eng->maxWidth, line.textWidth, &eng->maxWidth))
|
||
|
|
+ eng->maxWidth = QFIXED_MAX;
|
||
|
|
}
|
||
|
|
|
||
|
|
- if (line.textWidth > 0 && item < eng->layoutData->items.size())
|
||
|
|
- eng->maxWidth += lbh.spaceData.textWidth;
|
||
|
|
+ if (line.textWidth > 0 && item < eng->layoutData->items.size()) {
|
||
|
|
+ if (qAddOverflow(eng->maxWidth, lbh.spaceData.textWidth, &eng->maxWidth))
|
||
|
|
+ eng->maxWidth = QFIXED_MAX;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
line.textWidth += trailingSpace;
|
||
|
|
if (lbh.spaceData.length) {
|
||
|
|
--
|
||
|
|
2.30.0
|
||
|
|
|