Fixed bug in QClipData::fixup().

The bounding rect computed in fixup() is one pixel too wide, causing
potential memory corruption by painting outside device boundaries.

Reviewed-by: Trond

1 files changed, 24 insertions, 0 deletions

diff --git a/tests/auto/qpainter/tst_qpainter.cpp b/tests/auto/qpainter/tst_qpainter.cpp
index 87f9c13..af0f6cf 100644
--- a/tests/auto/qpainter/tst_qpainter.cpp
+++ b/tests/auto/qpainter/tst_qpainter.cpp
@@ -226,6 +226,7 @@ private slots:
     void extendedBlendModes();
 
     void zeroOpacity();
+    void clippingBug();
 
 private:
     void fillData();
@@ -4168,5 +4169,28 @@ void tst_QPainter::zeroOpacity()
     QCOMPARE(target.pixel(0, 0), 0xff000000);
 }
 
+void tst_QPainter::clippingBug()
+{
+    QImage img(32, 32, QImage::Format_ARGB32_Premultiplied);
+    img.fill(0);
+
+    QImage expected = img;
+    QPainter p(&expected);
+    p.fillRect(1, 1, 30, 30, Qt::red);
+    p.end();
+
+    QPainterPath path;
+    path.addRect(1, 1, 30, 30);
+    path.addRect(1, 1, 30, 30);
+    path.addRect(1, 1, 30, 30);
+
+    p.begin(&img);
+    p.setClipPath(path);
+    p.fillRect(0, 0, 32, 32, Qt::red);
+    p.end();
+
+    QCOMPARE(img, expected);
+}
+
 QTEST_MAIN(tst_QPainter)
 #include "tst_qpainter.moc"