summaryrefslogtreecommitdiffstats
path: root/src/svg
diff options
context:
space:
mode:
authorStian Sandvik Thomassen <stian.thomassen@nokia.com>2009-08-24 04:01:43 (GMT)
committerStian Sandvik Thomassen <stian.thomassen@nokia.com>2009-08-24 04:01:43 (GMT)
commit6c282e096c160ef0426466042bf4bb4e0e28f0b2 (patch)
treee9a6aad8c6edb83208232273e754142e61e19c36 /src/svg
parentf31a7b2d7f08c39dbe2e987ec53bff56ca89c3d1 (diff)
downloadQt-6c282e096c160ef0426466042bf4bb4e0e28f0b2.zip
Qt-6c282e096c160ef0426466042bf4bb4e0e28f0b2.tar.gz
Qt-6c282e096c160ef0426466042bf4bb4e0e28f0b2.tar.bz2
Prevented crash when parsing viewBox attribute value
The old code assumed viewBox value of the form "x y w h" or "x,y,w,h", and would crash when parsing "x,y w,h" (when accessing the fourth list item which would be out-of-bounds). Reviewed-by: Trond Reviewed-by: Kim
Diffstat (limited to 'src/svg')
-rw-r--r--src/svg/qsvghandler.cpp18
1 files changed, 9 insertions, 9 deletions
diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
index f34653d..f26bbd7 100644
--- a/src/svg/qsvghandler.cpp
+++ b/src/svg/qsvghandler.cpp
@@ -3012,16 +3012,16 @@ static QSvgNode *createSvgNode(QSvgNode *parent,
node->setHeight(int(height), type == QSvgHandler::LT_PERCENT);
}
-
+ QStringList viewBoxValues;
if (!viewBoxStr.isEmpty()) {
- QStringList lst = viewBoxStr.split(QLatin1Char(' '), QString::SkipEmptyParts);
- if (lst.count() != 4)
- lst = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts);
- QString xStr = lst.at(0).trimmed();
- QString yStr = lst.at(1).trimmed();
- QString widthStr = lst.at(2).trimmed();
- QString heightStr = lst.at(3).trimmed();
-
+ viewBoxStr = viewBoxStr.replace(QLatin1Char(' '), QLatin1Char(','));
+ viewBoxValues = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts);
+ }
+ if (viewBoxValues.count() == 4) {
+ QString xStr = viewBoxValues.at(0).trimmed();
+ QString yStr = viewBoxValues.at(1).trimmed();
+ QString widthStr = viewBoxValues.at(2).trimmed();
+ QString heightStr = viewBoxValues.at(3).trimmed();
QSvgHandler::LengthType lt;
qreal x = parseLength(xStr, lt, handler);