summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorEirik Aavitsland <eirik.aavitsland@qt.io>2018-08-03 13:25:15 +0200
committerEirik Aavitsland <eirik.aavitsland@qt.io>2018-08-09 09:26:25 +0000
commitac0a910756f91726e03c0e6a89d213bdb4f48fec (patch)
tree695fbe522fef8fe5c4feec27439fe6e97a201e84
parentb7321368924c4dbed81aa008d76ebfb1dffd7e60 (diff)
Check for QImage allocation failure in qgifhandler
Since image files easily can be (or corrupt files claim to be) huge, it is worth checking for out of memory situations. Change-Id: I635a3ec6852288079fdec4e14cf7e776fe59e9e0 Reviewed-by: Lars Knoll <lars.knoll@qt.io> (cherry picked from commit 2841e2b61e32f26900bde987d469c8b97ea31999) (cherry picked from commit f9324103a0f824de2c5243f07a86e7906b8a8ea6)
-rw-r--r--src/gui/image/qgifhandler.cpp7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/gui/image/qgifhandler.cpp b/src/gui/image/qgifhandler.cpp
index 4197d7e959..5d4a230af7 100644
--- a/src/gui/image/qgifhandler.cpp
+++ b/src/gui/image/qgifhandler.cpp
@@ -348,7 +348,8 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
(*image) = QImage(swidth, sheight, format);
bpl = image->bytesPerLine();
bits = image->bits();
- memset(bits, 0, image->byteCount());
+ if (bits)
+ memset(bits, 0, image->byteCount());
}
// Check if the previous attempt to create the image failed. If it
@@ -409,6 +410,10 @@ int QGIFFormat::decode(QImage *image, const uchar *buffer, int length,
backingstore = QImage(qMax(backingstore.width(), w),
qMax(backingstore.height(), h),
QImage::Format_RGB32);
+ if (backingstore.isNull()) {
+ state = Error;
+ return -1;
+ }
memset(backingstore.bits(), 0, backingstore.byteCount());
}
const int dest_bpl = backingstore.bytesPerLine();