0001-QSvgFont-Initialize-used-member-remove-unused.patch 2.0 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. From 3497a6b81f561f61ab784b2847f718e912b4d80c Mon Sep 17 00:00:00 2001
  2. From: =?UTF-8?q?Robert=20L=C3=B6hning?= <robert.loehning@qt.io>
  3. Date: Mon, 24 Apr 2023 15:27:17 +0200
  4. Subject: [PATCH] QSvgFont: Initialize used member, remove unused
  5. Credit to OSS-Fuzz
  6. [ChangeLog][QtSvg] Fixed undefined behavior from using uninitialized
  7. variable.
  8. Pick-to: 6.5 6.2 5.15
  9. Coverity-Id: 22618
  10. Change-Id: Id52277bb0e2845f4d342e187dbb8093e9276b70c
  11. Reviewed-by: Eskil Abrahamsen Blomfeldt <eskil.abrahamsen-blomfeldt@qt.io>
  12. Fixes: https://security-tracker.debian.org/tracker/CVE-2023-32573
  13. Upstream: https://codereview.qt-project.org/gitweb?p=qt%2Fqtsvg.git;a=commit;h=ff22c3ccf8ccf813fdcfda23f7740ba73ba5ce0a
  14. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
  15. ---
  16. src/svg/qsvgfont_p.h | 5 ++---
  17. src/svg/qsvghandler.cpp | 2 +-
  18. 2 files changed, 3 insertions(+), 4 deletions(-)
  19. diff --git a/src/svg/qsvgfont_p.h b/src/svg/qsvgfont_p.h
  20. index a7cc98b1..9cf3dfe3 100644
  21. --- a/src/svg/qsvgfont_p.h
  22. +++ b/src/svg/qsvgfont_p.h
  23. @@ -38,6 +38,7 @@ public:
  24. class Q_SVG_PRIVATE_EXPORT QSvgFont : public QSvgRefCounted
  25. {
  26. public:
  27. + static constexpr qreal DEFAULT_UNITS_PER_EM = 1000;
  28. QSvgFont(qreal horizAdvX);
  29. void setFamilyName(const QString &name);
  30. @@ -50,9 +51,7 @@ public:
  31. void draw(QPainter *p, const QPointF &point, const QString &str, qreal pixelSize, Qt::Alignment alignment) const;
  32. public:
  33. QString m_familyName;
  34. - qreal m_unitsPerEm;
  35. - qreal m_ascent;
  36. - qreal m_descent;
  37. + qreal m_unitsPerEm = DEFAULT_UNITS_PER_EM;
  38. qreal m_horizAdvX;
  39. QHash<QChar, QSvgGlyph> m_glyphs;
  40. };
  41. diff --git a/src/svg/qsvghandler.cpp b/src/svg/qsvghandler.cpp
  42. index 29ca7332..a8918489 100644
  43. --- a/src/svg/qsvghandler.cpp
  44. +++ b/src/svg/qsvghandler.cpp
  45. @@ -2622,7 +2622,7 @@ static bool parseFontFaceNode(QSvgStyleProperty *parent,
  46. qreal unitsPerEm = toDouble(unitsPerEmStr);
  47. if (!unitsPerEm)
  48. - unitsPerEm = 1000;
  49. + unitsPerEm = QSvgFont::DEFAULT_UNITS_PER_EM;
  50. if (!name.isEmpty())
  51. font->setFamilyName(name);
  52. --
  53. 2.46.0