From 6c282e096c160ef0426466042bf4bb4e0e28f0b2 Mon Sep 17 00:00:00 2001 From: Stian Sandvik Thomassen Date: Mon, 24 Aug 2009 14:01:43 +1000 Subject: Prevented crash when parsing viewBox attribute value The old code assumed viewBox value of the form "x y w h" or "x,y,w,h", and would crash when parsing "x,y w,h" (when accessing the fourth list item which would be out-of-bounds). Reviewed-by: Trond Reviewed-by: Kim --- src/svg/qsvghandler.cpp | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp index f34653d..f26bbd7 100644 --- a/src/svg/qsvghandler.cpp +++ b/src/svg/qsvghandler.cpp @@ -3012,16 +3012,16 @@ static QSvgNode *createSvgNode(QSvgNode *parent, node->setHeight(int(height), type == QSvgHandler::LT_PERCENT); } - + QStringList viewBoxValues; if (!viewBoxStr.isEmpty()) { - QStringList lst = viewBoxStr.split(QLatin1Char(' '), QString::SkipEmptyParts); - if (lst.count() != 4) - lst = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts); - QString xStr = lst.at(0).trimmed(); - QString yStr = lst.at(1).trimmed(); - QString widthStr = lst.at(2).trimmed(); - QString heightStr = lst.at(3).trimmed(); - + viewBoxStr = viewBoxStr.replace(QLatin1Char(' '), QLatin1Char(',')); + viewBoxValues = viewBoxStr.split(QLatin1Char(','), QString::SkipEmptyParts); + } + if (viewBoxValues.count() == 4) { + QString xStr = viewBoxValues.at(0).trimmed(); + QString yStr = viewBoxValues.at(1).trimmed(); + QString widthStr = viewBoxValues.at(2).trimmed(); + QString heightStr = viewBoxValues.at(3).trimmed(); QSvgHandler::LengthType lt; qreal x = parseLength(xStr, lt, handler); -- cgit v0.12