Merge branch '4.5'

1 files changed, 3 insertions, 12 deletions

diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index 578a815..30c454c 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -3917,11 +3917,7 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
 {
     Q_ASSERT(c1->clipSpanHeight == c2->clipSpanHeight && c1->clipSpanHeight == result->clipSpanHeight);
 
-    // ### buffer overflow possible
-    const int BUFFER_SIZE = 4096;
-    int buffer[BUFFER_SIZE];
-    int *b = buffer;
-    int bsize = BUFFER_SIZE;
+    QVarLengthArray<short, 4096> buffer;
 
     QClipData::ClipLine *c1ClipLines = const_cast<QClipData *>(c1)->clipLines();
     QClipData::ClipLine *c2ClipLines = const_cast<QClipData *>(c2)->clipLines();
@@ -3948,11 +3944,8 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
         // find required length
         int max = qMax(c1_spans[c1_count - 1].x + c1_spans[c1_count - 1].len,
                        c2_spans[c2_count - 1].x + c2_spans[c2_count - 1].len);
-        if (max > bsize) {
-            b = (int *)realloc(bsize == BUFFER_SIZE ? 0 : b, max*sizeof(int));
-            bsize = max;
-        }
-        memset(buffer, 0, BUFFER_SIZE * sizeof(int));
+        buffer.resize(max);
+        memset(buffer.data(), 0, buffer.size() * sizeof(short));
 
         // Fill with old spans.
         for (int i = 0; i < c1_count; ++i) {
@@ -3988,8 +3981,6 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
             result->appendSpan(sx, x - sx, y, coverage);
         }
     }
-    if (b != buffer)
-        free(b);
 }
 
 void QRasterPaintEnginePrivate::initializeRasterizer(QSpanData *data)