1 files changed, 3 insertions, 14 deletions
diff --git a/src/gui/painting/qpaintengine_raster.cpp b/src/gui/painting/qpaintengine_raster.cpp
index 3f85095..30c454c 100644
--- a/src/gui/painting/qpaintengine_raster.cpp
+++ b/src/gui/painting/qpaintengine_raster.cpp
@@ -3917,11 +3917,7 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
 {
     Q_ASSERT(c1->clipSpanHeight == c2->clipSpanHeight && c1->clipSpanHeight == result->clipSpanHeight);
 
-    // ### buffer overflow possible
-    const int BUFFER_SIZE = 4096;
-    int buffer[BUFFER_SIZE];
-    int *b = buffer;
-    int bsize = BUFFER_SIZE;
+    QVarLengthArray<short, 4096> buffer;
 
     QClipData::ClipLine *c1ClipLines = const_cast<QClipData *>(c1)->clipLines();
     QClipData::ClipLine *c2ClipLines = const_cast<QClipData *>(c2)->clipLines();
@@ -3948,11 +3944,8 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
         // find required length
         int max = qMax(c1_spans[c1_count - 1].x + c1_spans[c1_count - 1].len,
                        c2_spans[c2_count - 1].x + c2_spans[c2_count - 1].len);
-        if (max > bsize) {
-            b = (int *)realloc(bsize == BUFFER_SIZE ? 0 : b, max*sizeof(int));
-            bsize = max;
-        }
-        memset(buffer, 0, BUFFER_SIZE * sizeof(int));
+        buffer.resize(max);
+        memset(buffer.data(), 0, buffer.size() * sizeof(short));
 
         // Fill with old spans.
         for (int i = 0; i < c1_count; ++i) {
@@ -3988,8 +3981,6 @@ static void qt_merge_clip(const QClipData *c1, const QClipData *c2, QClipData *r
             result->appendSpan(sx, x - sx, y, coverage);
         }
     }
-    if (b != buffer)
-        free(b);
 }
 
 void QRasterPaintEnginePrivate::initializeRasterizer(QSpanData *data)
@@ -4475,14 +4466,12 @@ void QClipData::fixup()
         if (sl != left || sr != right)
             isRect = false;
     }
-    ++xmax;
 //     qDebug("xmin=%d,xmax=%d,ymin=%d,ymax=%d %s", xmin, xmax, ymin, ymax, isRect ? "rectangular" : "");
 
     if (isRect) {
         hasRectClip = true;
         clipRect.setRect(xmin, ymin, xmax - xmin, ymax - ymin);
     }
-
 }
 
 /*