Merge pull request #9064 from mhugo/fix_20831

Hugo Mercier · web-flow · commit ed45181bee3d · 2019-02-04T08:29:36.000+01:00
Avoid undefined behaviour with signed integer overflow
diff --git a/src/gui/editorwidgets/qgsrangewidgetwrapper.cpp b/src/gui/editorwidgets/qgsrangewidgetwrapper.cpp
@@ -145,12 +145,12 @@ void QgsRangeWidgetWrapper::initWidget( QWidget *editor )
     int minval = min.toInt();
     if ( allowNull )
     {
-      int stepval = step.isValid() ? step.toInt() : 1;
-      int newMinval = minval - stepval;
+      uint stepval = step.isValid() ? step.toUInt() : 1;
       // make sure there is room for a new value (i.e. signed integer does not overflow)
-      if ( newMinval < minval )
+      int minvalOverflow = uint( minval ) - stepval;
+      if ( minvalOverflow < minval )
       {
-        minval = newMinval;
+        minval = minvalOverflow;
       }
       mIntSpinBox->setValue( minval );
       QgsSpinBox *intSpinBox( qobject_cast<QgsSpinBox *>( mIntSpinBox ) );

Original file line number	Diff line number	Diff line change
`@@ -145,12 +145,12 @@ void QgsRangeWidgetWrapper::initWidget( QWidget *editor )`
`145`	`145`	`int minval = min.toInt();`
`146`	`146`	`if ( allowNull )`
`147`	`147`	`{`
`148`		`- int stepval = step.isValid() ? step.toInt() : 1;`
`149`		`- int newMinval = minval - stepval;`
	`148`	`+ uint stepval = step.isValid() ? step.toUInt() : 1;`
`150`	`149`	`// make sure there is room for a new value (i.e. signed integer does not overflow)`
`151`		`- if ( newMinval < minval )`
	`150`	`+ int minvalOverflow = uint( minval ) - stepval;`
	`151`	`+ if ( minvalOverflow < minval )`
`152`	`152`	`{`
`153`		`- minval = newMinval;`
	`153`	`+ minval = minvalOverflow;`
`154`	`154`	`}`
`155`	`155`	`mIntSpinBox->setValue( minval );`
`156`	`156`	`QgsSpinBox intSpinBox( qobject_cast<QgsSpinBox >( mIntSpinBox ) );`