Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
6.4.0 Beta2
-
None
-
9807c4e5af (qt/qtbase/dev) 9807c4e5af (qt/tqtc-qtbase/dev) 42f1166a7f (qt/qtbase/6.3) 42f1166a7f (qt/tqtc-qtbase/6.3) 9fe9c41f83 (qt/qtbase/6.4.0) 7b807cf2f8 (qt/tqtc-qtbase/6.2) 9fe9c41f83 (qt/tqtc-qtbase/6.4.0) 92e38ed3d4 (qt/qtbase/6.4)
Description
while (i < fragLen) {
if (col >= ColumnLimit) {
m_stream << Newline << wrapIndentString;
col = m_wrappedLineIndent;
while (fragmentText[i].isSpace())
++i;
}
The inner loop allows i to exceed fragLen, so it can go out of bounds.
Attachments
Issue Links
- relates to
-
-
- Reported
-
| For Gerrit Dashboard: QTBUG-104999 | ||||||
|---|---|---|---|---|---|---|
| # | Subject | Branch | Project | Status | CR | V |
| 431828,3 | Avoid crash in QTextMarkdownWriter::writeBlock() | dev | qt/qtbase | Status: MERGED | +2 | 0 |
| 431881,2 | Avoid crash in QTextMarkdownWriter::writeBlock() | 6.4.0 | qt/qtbase | Status: MERGED | +2 | 0 |
| 431882,2 | Avoid crash in QTextMarkdownWriter::writeBlock() | 6.4 | qt/qtbase | Status: MERGED | +2 | 0 |
| 431883,2 | Avoid crash in QTextMarkdownWriter::writeBlock() | 6.3 | qt/qtbase | Status: MERGED | +2 | 0 |
| 431884,2 | Avoid crash in QTextMarkdownWriter::writeBlock() | tqtc/lts-6.2 | qt/tqtc-qtbase | Status: MERGED | +2 | 0 |