Fixed memory corruption issue in qt_blurImage for Indexed8 images.

If transposed was set to 0 we did not check the color depth of the image
and ended up with a buffer overflow.

Reviewed-by: Jens Bache-Wiig

1 files changed, 20 insertions, 0 deletions

diff --git a/tests/auto/qpixmapfilter/tst_qpixmapfilter.cpp b/tests/auto/qpixmapfilter/tst_qpixmapfilter.cpp
index f0f087d985..1f51d519a6 100644
--- a/tests/auto/qpixmapfilter/tst_qpixmapfilter.cpp
+++ b/tests/auto/qpixmapfilter/tst_qpixmapfilter.cpp
@@ -72,6 +72,7 @@ private slots:
     void convolutionBoundingRectFor();
     void convolutionDrawSubRect();
     void dropShadowBoundingRectFor();
+    void blurIndexed8();
 
     void testDefaultImplementations();
 };
@@ -423,6 +424,25 @@ void tst_QPixmapFilter::dropShadowBoundingRectFor()
     QCOMPARE(filter.boundingRectFor(rect3), rect3.adjusted(-delta - 10, -delta - 10, 0, 0));
 }
 
+void qt_blurImage(QImage &blurImage, qreal radius, bool quality, int transposed);
+
+void tst_QPixmapFilter::blurIndexed8()
+{
+    QImage img(16, 32, QImage::Format_Indexed8);
+    img.setColorCount(256);
+    for (int i = 0; i < 256; ++i)
+        img.setColor(i, qRgb(i, i, i));
+
+    img.fill(255);
+
+    QImage original = img;
+    qt_blurImage(img, 10, true, false);
+    QCOMPARE(original.size(), img.size());
+
+    original = img;
+    qt_blurImage(img, 10, true, true);
+    QCOMPARE(original.size(), QSize(img.height(), img.width()));
+}
 
 QTEST_MAIN(tst_QPixmapFilter)
 #include "tst_qpixmapfilter.moc"