diff options
author | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2018-08-03 13:25:15 +0200 |
---|---|---|
committer | Eirik Aavitsland <eirik.aavitsland@qt.io> | 2018-08-09 09:26:25 +0000 |
commit | ac0a910756f91726e03c0e6a89d213bdb4f48fec (patch) | |
tree | 695fbe522fef8fe5c4feec27439fe6e97a201e84 | |
parent | b7321368924c4dbed81aa008d76ebfb1dffd7e60 (diff) |
Check for QImage allocation failure in qgifhandler
Since image files easily can be (or corrupt files claim to be) huge,
it is worth checking for out of memory situations.
Change-Id: I635a3ec6852288079fdec4e14cf7e776fe59e9e0
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
(cherry picked from commit 2841e2b61e32f26900bde987d469c8b97ea31999)
(cherry picked from commit f9324103a0f824de2c5243f07a86e7906b8a8ea6)
-rw-r--r-- | src/gui/image/qgifhandler.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp index 4197d7e959..5d4a230af7 100644 --- a/src/gui/image/qgifhandler.cpp +++ b/src/gui/image/qgifhandler.cpp @@ -348,7 +348,8 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, (*image) = QImage(swidth, sheight, format); bpl = image->bytesPerLine(); bits = image->bits(); - memset(bits, 0, image->byteCount()); + if (bits) + memset(bits, 0, image->byteCount()); } // Check if the previous attempt to create the image failed. If it @@ -409,6 +410,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length, backingstore = QImage(qMax(backingstore.width(), w), qMax(backingstore.height(), h), QImage::Format_RGB32); + if (backingstore.isNull()) { + state = Error; + return -1; + } memset(backingstore.bits(), 0, backingstore.byteCount()); } const int dest_bpl = backingstore.bytesPerLine(); |