Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-134286

QSortFilterProxyModel memory overflow when source model emits dataChanged() with out of bound column numbers

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • P1: Critical
    • None
    • 6.8
    • Core: Item Models
    • None
    • All

    Description

      When a custom source model emits dataChanged() with out of bound column numbers in bottom right index (e.g. it's buggued and uses rowColumns() instead of rowColumns()-1), then QSortFilterProxyModel emits dataChanged() with totally random column number, often negative, often huge positive number (in the latest case it leads to long cpu intensive loops and pause in item view).

      Moreover when reading the code I think this randomness is due to a memory overflow when calling m->proxy_columns.at() with oob argument.

      qsortfilterproxymodel.cpp lines 1516 to 1524 (in 6.8.0 branch):

       

      int source_right_column = source_bottom_right.column();
      while (source_right_column > source_top_left.column()
               && m->proxy_columns.at(source_right_column) == -1)
                  --source_right_column;
      if (m->proxy_columns.at(source_right_column) != -1) {
        const QModelIndex proxy_bottom_right = create_index(
              proxy_end_row, m->proxy_columns.at(source_right_column), it);
        emit q->dataChanged(proxy_top_left, proxy_bottom_right, roles);
      } 

      On first line source column is taken as is, it should probably be checked versus max column number

      Maybe this way:

      int source_right_column = std::max(source_bottom_right.column(),
                                         m->proxy_columns.size()-1);  

      I didn't test it or compile it, this is just an idea.

      I can write the commit if you want, but I'm not sure the right way to start contributing to Qt (I did a few commits a long time ago I forgot and the process may have change): on which branch whould I do it ? 6.9.0 ?

       

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            dfaure_kdab David Faure
            g76r Greg
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Gerrit Reviews

                There are no open Gerrit changes