Prevent crash due to giving QWidget::update() a large region.

Similar to what change a298216bb4383dbe96 does for update(QRect) we clip
the update region against the widget's rect and return if it's empty.
Otherwise we risk ending up with update rects that are larger than
INT_MAX due to multiple update rects being merged.

Task-number: QTBUG-30876
Change-Id: Idf695b1fdca50449a1e5ddf37500653de290590c
Reviewed-by: Gunnar Sletta <gunnar.sletta@digia.com>
(cherry picked from commit 69ee30260a667b2b977a0d4b52abf6537521cce8)

1 files changed, 8 insertions, 3 deletions

diff --git a/src/gui/kernel/qwidget.cpp b/src/gui/kernel/qwidget.cpp
index 481f323..53c1d3f 100644
--- a/src/gui/kernel/qwidget.cpp
+++ b/src/gui/kernel/qwidget.cpp
@@ -10599,8 +10599,13 @@ void QWidget::update(const QRegion &rgn)
     if (!isVisible() || !updatesEnabled() || rgn.isEmpty())
         return;
 
+    QRegion r = rgn & QWidget::rect();
+
+    if (r.isEmpty())
+        return;
+
     if (testAttribute(Qt::WA_WState_InPaintEvent)) {
-        QApplication::postEvent(this, new QUpdateLaterEvent(rgn));
+        QApplication::postEvent(this, new QUpdateLaterEvent(r));
         return;
     }
 
@@ -10613,9 +10618,9 @@ void QWidget::update(const QRegion &rgn)
 #endif // QT_MAC_USE_COCOA
         QTLWExtra *tlwExtra = window()->d_func()->maybeTopData();
         if (tlwExtra && !tlwExtra->inTopLevelResize && tlwExtra->backingStore)
-            tlwExtra->backingStore->markDirty(rgn, this);
+            tlwExtra->backingStore->markDirty(r, this);
     } else {
-        d_func()->repaint_sys(rgn);
+        d_func()->repaint_sys(r);
     }
 }