Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-2 into 4.7-integration

* '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-2:
  Added test case for corrupt pixel count in XPM image.
  QImage crash when invalid XPM is read.
  Fix an issue with removing rows in a table model.

6 files changed, 39 insertions, 4 deletions

diff --git a/src/gui/image/qxpmhandler.cpp b/src/gui/image/qxpmhandler.cpp
index a02b3ff..76cd813 100644
--- a/src/gui/image/qxpmhandler.cpp
+++ b/src/gui/image/qxpmhandler.cpp
@@ -882,7 +882,7 @@ static bool read_xpm_body(
     QByteArray buf(200, 0);
     int i;
 
-    if (cpp > 15)
+    if (cpp < 0 || cpp > 15)
         return false;
 
     // For > 256 colors, we delay creation of the image until
diff --git a/src/sql/models/qsqltablemodel.cpp b/src/sql/models/qsqltablemodel.cpp
index 4df1d63..bf7c0aa 100644
--- a/src/sql/models/qsqltablemodel.cpp
+++ b/src/sql/models/qsqltablemodel.cpp
@@ -657,7 +657,7 @@ bool QSqlTableModel::insertRowIntoTable(const QSqlRecord &values)
         return false;
     }
 
-    return d->exec(stmt, prepStatement, rec);
+    return d->exec(stmt, prepStatement, rec, QSqlRecord() /* no where values */);
 }
 
 /*!
@@ -695,7 +695,7 @@ bool QSqlTableModel::deleteRowFromTable(int row)
     }
     stmt.append(QLatin1Char(' ')).append(where);
 
-    return d->exec(stmt, prepStatement, whereValues);
+    return d->exec(stmt, prepStatement, QSqlRecord() /* no new values */, whereValues);
 }
 
 /*!
diff --git a/src/sql/models/qsqltablemodel_p.h b/src/sql/models/qsqltablemodel_p.h
index d2b96e6..f4f3811 100644
--- a/src/sql/models/qsqltablemodel_p.h
+++ b/src/sql/models/qsqltablemodel_p.h
@@ -75,7 +75,7 @@ public:
     QSqlRecord record(const QVector<QVariant> &values) const;
 
     bool exec(const QString &stmt, bool prepStatement,
-              const QSqlRecord &rec, const QSqlRecord &whereValues = QSqlRecord());
+              const QSqlRecord &rec, const QSqlRecord &whereValues);
     virtual void revertCachedRow(int row);
     void revertInsertedRow();
     bool setRecord(int row, const QSqlRecord &record);
diff --git a/tests/auto/qimagereader/images/corrupt-pixel-count.xpm b/tests/auto/qimagereader/images/corrupt-pixel-count.xpm
new file mode 100644
index 0000000..3a736ff
--- /dev/null
+++ b/tests/auto/qimagereader/images/corrupt-pixel-count.xpm
@@ -0,0 +1,11 @@
+/* XPM */
+static const char *marble_xpm[] = {
+/* width height num_colors chars_per_pixel */
+"2 2 2 -2",
+/* colors */
+"a c #adadad",
+"b c #dedede",
+/* pixels */
+"ab",
+"ba"
+};
diff --git a/tests/auto/qimagereader/tst_qimagereader.cpp b/tests/auto/qimagereader/tst_qimagereader.cpp
index 69e8ead..5321864 100644
--- a/tests/auto/qimagereader/tst_qimagereader.cpp
+++ b/tests/auto/qimagereader/tst_qimagereader.cpp
@@ -1399,6 +1399,9 @@ void tst_QImageReader::readFromResources_data()
     QTest::newRow("corrupt-pixels.xpm") << QString("corrupt-pixels.xpm")
                                                << QByteArray("xpm") << QSize(0, 0)
                                                << QString("QImage: XPM pixels missing on image line 3");
+    QTest::newRow("corrupt-pixel-count.xpm") << QString("corrupt-pixel-count.xpm")
+                                             << QByteArray("xpm") << QSize(0, 0)
+                                             << QString("");
     QTest::newRow("marble.xpm") << QString("marble.xpm")
                                        << QByteArray("xpm") << QSize(240, 240)
                                        << QString("");
diff --git a/tests/auto/qsqltablemodel/tst_qsqltablemodel.cpp b/tests/auto/qsqltablemodel/tst_qsqltablemodel.cpp
index f7d2180..bf68375 100644
--- a/tests/auto/qsqltablemodel/tst_qsqltablemodel.cpp
+++ b/tests/auto/qsqltablemodel/tst_qsqltablemodel.cpp
@@ -773,6 +773,27 @@ void tst_QSqlTableModel::removeInsertedRow()
     QCOMPARE(model.data(model.index(0, 1)).toString(), QString("harry"));
     QCOMPARE(model.data(model.index(1, 1)).toString(), QString("trond"));
     QCOMPARE(model.data(model.index(2, 1)).toString(), QString("vohi"));
+
+    // Now insert a row with a null, and check that removing it also works (QTBUG-15979 etc)
+    model.insertRow(1);
+    model.setData(model.index(1,0), 55);
+    model.setData(model.index(1,1), QString("null columns"));
+    model.setData(model.index(1,2), QVariant());
+
+    model.submitAll();
+
+    QCOMPARE(model.rowCount(), 4);
+    QCOMPARE(model.data(model.index(3, 0)).toInt(), 55);
+    QCOMPARE(model.data(model.index(3, 1)).toString(), QString("null columns"));
+    QCOMPARE(model.data(model.index(3, 2)).isNull(), true);
+
+    QVERIFY(model.removeRow(3));
+    model.submitAll();
+    QCOMPARE(model.rowCount(), 3);
+
+    QCOMPARE(model.data(model.index(0, 1)).toString(), QString("harry"));
+    QCOMPARE(model.data(model.index(1, 1)).toString(), QString("trond"));
+    QCOMPARE(model.data(model.index(2, 1)).toString(), QString("vohi"));
 }
 
 void tst_QSqlTableModel::removeInsertedRows()