Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-91261

Invalid pointer return with QGridLayout::itemAt(-1)

    XMLWordPrintable

    Details

    • Platform/s:
      All
    • Commits:
      c47bb4478a4c3a29c0505d7d89755f40601b326f (qt/qtbase/dev) d3b24a14bb9e6c258e9183dc05893020d81c9a9f (qt/qtbase/6.0) 466177c9112de8b7a0bd0994767e8dfb8034d67f (qt/qtbase/6.1) ce61defc4d2c611c15eeffd3070a0e71f4373550 (qt/tqtc-qtbase/5.15)

      Description

      The function QGridLayout::itemAt does not check for negative index and will return an invalid pointer as a result. This also affects QGridLayout::takeAt. Notice that the code in the below only checks the upper bound, it should also check for index >= 0.

       qtbase/src/widgets/kernel/qgridlayout.cpp, Lines 151-172

      inline QLayoutItem *itemAt(int index) const {
          if (index < things.count())
              return things.at(index)->item();
          else
              return 0;
      }
      inline QLayoutItem *takeAt(int index) {
          Q_Q(QGridLayout);
          if (index < things.count()) {
              if (QGridBox *b = things.takeAt(index)) {
                  QLayoutItem *item = b->takeItem();
                  if (QLayout *l = item->layout()) {
                      // sanity check in case the user passed something weird to QObject::setParent()
                      if (l->parent() == q)
                          l->setParent(0);
                  }
                  delete b;
                  return item;
              }
          }
          return 0;
      }

       

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            Assignee:
            qt.team.quick.subscriptions Qt Quick and Widgets Team
            Reporter:
            droidmonkey Jonathan White
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:

                Gerrit Reviews

                There are no open Gerrit changes