Fix crash in QVariant::canConvert.

The function was crashing when an unsupported type id was given
as an input argument.

Change-Id: I2b0e3e6d43f6f248dc71532f8e6485efe68e8120
Reviewed-by: Stephen Kelly <stephen.kelly@kdab.com>

diff --git a/src/corelib/kernel/qvariant.cpp b/src/corelib/kernel/qvariant.cpp
index 029a261..c845619 100644 (file)
--- a/src/corelib/kernel/qvariant.cpp
+++ b/src/corelib/kernel/qvariant.cpp
@@ -2445,6 +2445,8 @@ bool QVariant::canConvert(int targetTypeId) const
 
     if (currentType == uint(targetTypeId))
         return true;
+    if (targetTypeId < 0 || targetTypeId >= QMetaType::User)
+        return false;
 
     // FIXME It should be LastCoreType intead of Uuid
     if (currentType > int(QMetaType::QUuid) || targetTypeId > int(QMetaType::QUuid)) {

diff --git a/tests/auto/corelib/kernel/qvariant/tst_qvariant.cpp b/tests/auto/corelib/kernel/qvariant/tst_qvariant.cpp
index ccdab17..d78759e 100644 (file)
--- a/tests/auto/corelib/kernel/qvariant/tst_qvariant.cpp
+++ b/tests/auto/corelib/kernel/qvariant/tst_qvariant.cpp
@@ -612,6 +612,12 @@ void tst_QVariant::canConvert()
     QCOMPARE(val.canConvert(QVariant::Time), TimeCast);
     QCOMPARE(val.canConvert(QVariant::UInt), UIntCast);
     QCOMPARE(val.canConvert(QVariant::ULongLong), ULongLongCast);
+
+    // Invalid type ids
+    QCOMPARE(val.canConvert(-1), false);
+    QCOMPARE(val.canConvert(-23), false);
+    QCOMPARE(val.canConvert(-23876), false);
+    QCOMPARE(val.canConvert(23876), false);
 }
 
 void tst_QVariant::toInt_data()