Prevented crash when parsing viewBox attribute value

The old code assumed viewBox value of the form "x y w h" or "x,y,w,h",
and would crash when parsing "x,y w,h" (when accessing the fourth list
item which would be out-of-bounds).

Reviewed-by: Trond
Reviewed-by: Kim

1 files changed, 9 insertions, 9 deletions

diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
index f34653d..f26bbd7 100644
--- a/src/svg/qsvghandler.cpp
+++ b/src/svg/qsvghandler.cpp
@@ -3012,16 +3012,16 @@ static QSvgNode *createSvgNode(QSvgNode *parent,
         node->setHeight(int(height), type == QSvgHandler::LT_PERCENT);
     }
 
-
+    QStringList viewBoxValues;
     if (!viewBoxStr.isEmpty()) {
-        QStringList lst = viewBoxStr.split(QLatin1Char(' '), QString::SkipEmptyParts);
-        if (lst.count() != 4)
-            lst = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts);
-        QString xStr      = lst.at(0).trimmed();
-        QString yStr      = lst.at(1).trimmed();
-        QString widthStr  = lst.at(2).trimmed();
-        QString heightStr = lst.at(3).trimmed();
-
+        viewBoxStr = viewBoxStr.replace(QLatin1Char(' '), QLatin1Char(','));
+        viewBoxValues = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts);
+    }
+    if (viewBoxValues.count() == 4) {
+        QString xStr      = viewBoxValues.at(0).trimmed();
+        QString yStr      = viewBoxValues.at(1).trimmed();
+        QString widthStr  = viewBoxValues.at(2).trimmed();
+        QString heightStr = viewBoxValues.at(3).trimmed();
 
         QSvgHandler::LengthType lt;
         qreal x = parseLength(xStr, lt, handler);