Merge branch '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1 into 4.7-integration

* '4.7' of scm.dev.nokia.troll.no:qt/oslo-staging-1:
  Don't rely on uninitialized data
  Don't realloc user-provided buffer

2 files changed, 3 insertions, 2 deletions

diff --git a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
index ce4d4ac..1021b02 100644
--- a/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
+++ b/src/3rdparty/harfbuzz/src/harfbuzz-shaper.cpp
@@ -643,6 +643,7 @@ void HB_GetCharAttributes(const HB_UChar16 *string, hb_uint32 stringLength,
                           const HB_ScriptItem *items, hb_uint32 numItems,
                           HB_CharAttributes *attributes)
 {
+    memset(attributes, 0, stringLength * sizeof(HB_CharAttributes));
     calcLineBreaks(string, stringLength, attributes);
 
     for (hb_uint32 i = 0; i < numItems; ++i) {
diff --git a/src/corelib/tools/qtextboundaryfinder.cpp b/src/corelib/tools/qtextboundaryfinder.cpp
index 34bc406..47319d4 100644
--- a/src/corelib/tools/qtextboundaryfinder.cpp
+++ b/src/corelib/tools/qtextboundaryfinder.cpp
@@ -199,11 +199,11 @@ QTextBoundaryFinder &QTextBoundaryFinder::operator=(const QTextBoundaryFinder &o
     chars = other.chars;
     length = other.length;
     pos = other.pos;
-    freePrivate = true;
 
     QTextBoundaryFinderPrivate *newD = (QTextBoundaryFinderPrivate *)
-        realloc(d, length*sizeof(HB_CharAttributes));
+        realloc(freePrivate ? d : 0, length*sizeof(HB_CharAttributes));
     Q_CHECK_PTR(newD);
+    freePrivate = true;
     d = newD;
     memcpy(d, other.d, length*sizeof(HB_CharAttributes));